php - 上传文件并访问$_FILES

Question

我正在尝试将文件上传到某个目录。该目录记录在数据库中。但是，代码无法读取 $_FILES 我每次尝试上传文件时都会得到空值。但其他输入数据都记录到数据库中。发生的情况是我无法在数据库中记录文件名，它只是空白。

if(isset($_POST['btn-upload'])){ 
    $record_title = $_POST['record_title'];
    $record_recieved_date_time = $_POST['record_recieved_date_time'];
    $record_checked_date_time = $_POST['record_checked_date_time'];
    $record_approved_date_time = $_POST['record_approved_date_time'];
    $record_status = $_POST['record_status'];
    $record_remarks = $_POST['record_remarks'];
    $record_type = $_POST['record_type'];
    $file = $_FILES['file']['name'];

    $sql = "INSERT INTO records (record_id , record_title ,    record_recieved_date_time , record_checked_date_time , record_approved_date_time , record_status  ,record_remarks , file , record_type)
            VALUES (NULL, '$record_title' , '$record_recieved_date_time','$record_checked_date_time','$record_approved_date_time' , '$record_status ' , '$record_remarks' , '$file' , '1')";

    if (mysqli_query($dbconfig, $sql)) {
        header('Location:memberAWP.php');
    } else {
        echo "Error: " . $sql . "<br>" . mysqli_error($dbconfig);
    }
}

这是表单，我在 Bootstrap 的帮助下使用模态

<form method="post" action="" enctype="multipart/form-data name="loginform"   class="form-horizontal">
                              <div class="form-group">
                                <label class="control-label col-sm-2" for="record_title"> TITLE </label>
                                <div class="col-sm-10">
                                  <input type="text" class="form-control" id="record_title" name = "record_title" placeholder="Enter Title">
                                </div>
                              </div>
                              <div class="form-group">
                                <label class="control-label col-sm-2" for="record_recieved_date_time"> RECIEVED DATE / TIME </label>
                                <div class="col-sm-10">
                                  <input type="datetime-local" class="form-control" id="record_recieved_date_time"  name = "record_recieved_date_time" placeholder="Enter RECIEVED DATE / TIME">
                                </div>
                              </div>
                              <div class="form-group">
                                <label class="control-label col-sm-2" for="record_checked_date_time"> CHECKED DATE / TIME </label>
                                <div class="col-sm-10">
                                  <input type="datetime-local" class="form-control" id="record_checked_date_time" name = "record_checked_date_time" placeholder="Enter CHECKED DATE / TIME">
                                </div>
                              </div>
                              <div class="form-group">
                                <label class="control-label col-sm-2" for="record_approved_date_time"> APPROVED DATE / TIME</label>
                                <div class="col-sm-10">
                                  <input type="datetime-local" class="form-control" id="record_approved_date_time" name = "record_approved_date_time" placeholder="Enter APPROVED DATE / TIME">
                                </div>
                              </div>
                              <div class="form-group">
                                <label class="control-label col-sm-2" for="record_status"> STATUS </label>
                                <div class="col-sm-10">
                                  <input type="text" class="form-control" id="record_status" name = "record_status" placeholder="Enter STATUS">
                                </div>
                              </div>
                              <div class="form-group">
                                <label class="control-label col-sm-2" for="record_remarks"> REMARKS </label>
                                <div class="col-sm-10">
                                  <input type="text" class="form-control" id="record_remarks" name = "record_remarks" placeholder="Enter REMARKS">
                                </div>
                              </div>                                  
                              <div class="form-group">
                                <label class="control-label col-sm-2" for="file"> ATTACHMENTS </label>
                                <div class="col-sm-10">
                                  <input type="file" class="form-control" id="file" name="file" placeholder="Enter ATTACHMENTS">
                                </div>
                              </div>                                  

                              <div class="form-group">
                                <div class="col-sm-offset-2 col-sm-10">
                                  <button type="submit" name="submit" value="submit" class="btn btn-default">Submit</button>
                                </div>
                              </div>
                            </form>

Answer 1

if( isset( $_POST['btn-upload'], $_FILES['file'] ) ){
    /*
        The sql is vulnerable to sql injection as you directly embed variables within the sql
        rather than using `prepared statements` so some extra care ought to be taken with the supplied
        data, perhaps use:

        filter_input( INPUT_POST, 'record_title', FILTER_SANITIZE_STRING );


    */
    $record_title = $_POST['record_title'];
    $record_recieved_date_time = $_POST['record_recieved_date_time'];
    $record_checked_date_time = $_POST['record_checked_date_time'];
    $record_approved_date_time = $_POST['record_approved_date_time'];
    $record_status = $_POST['record_status'];
    $record_remarks = $_POST['record_remarks'];
    $record_type = $_POST['record_type'];

    /*
        Access the uploaded file as an object for simplicity
        and use the values for saving the file etc
    */
    $obj=(object)$_FILES['file'];
    $file = $obj->name;
    $size = $obj->size;
    $tmp  = $obj->tmp_name;
    $type = $obj->type;
    $error= $obj->error;



    if( is_uploaded_file( $tmp ) && $error == UPLOAD_ERR_OK ){

        /* determine the location the file should be saved to */
        $destination = '/path/to/folder/' . $file;

        /* Save the file */
        $result = move_uploaded_file( $tmp, $destination );


        /* Proceed with the sql command if the file was saved OK */
        if( $result ){
            $sql = "INSERT INTO records ( `record_title`, `record_recieved_date_time`, `record_checked_date_time`, `record_approved_date_time`, `record_status`, `record_remarks`, `file`, `record_type`)
                VALUES ( '$record_title', '$record_recieved_date_time', '$record_checked_date_time', '$record_approved_date_time', '$record_status', '$record_remarks', '$file', '1' )";

            $result = mysqli_query( $dbconfig, $sql );

            if( $result )header('Location:memberAWP.php');
            else echo "Error: " . $sql . "<br>" . mysqli_error($dbconfig);

        }
    }
}

正如评论中所指出的，确保表单具有正确的 enctype 属性集 - 对于文件上传，它应该是 enctype='multipart/form-data'

除非您使用 move_uploaded_file() 函数，否则文件将在垃圾收集删除它以及对该文件的引用之前在 tmp 目录中保留一段有限的时间(在数据库)将不再有效。