php - 将多张照片插入mysql数据库

Question

这是我的代码，它与数据库有连接:

session_start();

require 'config2.php';
require_once 'user.class.php';

$target = "uploads/"; 
$target1 = "uploads/"; 
$target = $target . basename( $_FILES['photo']['tmp_name']); 
$target1 = $target1 . basename( $_FILES['photo1']['tmp_name']); 

//This gets all the other information from the form 
$login = $_SESSION['login'];    
$name=$_POST['name']; 
$name1 =$_POST['name1'];
$pic=($_FILES['photo']['name']); 
$pic1=($_FILES['photo1']['name1']); 

$id=$_SESSION['id'];

// Connects to your Database 
print_r($_POST);
print_r($_FILES);
print_r($_SESSION);
print_r($_GET);

//$op = mysql_query("select id from users where id = '$id' ");
//Writes the information to the database 
mysql_query("INSERT INTO users (name, photo, name1, photo1) VALUES ('$name', '$photo', '$name1', '$photo1') where login = '$login'") ; 

// mysql_query("UPDATE users SET name='$name', photo = '$pic', name1 = '$name1', photo1 = '$pic1' WHERE  login = '$login' ");
//Writes the photo to the server 
if(move_uploaded_file($_FILES['photo']['tmp_name'] ,$target) )
{ 
  //Tells you if its all ok 
  echo "The file ". basename( $_FILES['uploadedfile']['name'] ). " has been uploaded,        and your information has been added to the directory"; 
  echo "<a href = 'profile.php?id=$id'>back</a>"; 
} 

if(move_uploaded_file($_FILES['photo1']['tmp_name'] ,$target1) )
{ 
  //Tells you if its all ok 
  echo "The file ". basename( $_FILES['uploadedfile']['name1'] ). " has been uploaded, and your information has been added to the directory"; 
  echo "<a href = 'profile.php?id=$id'>back</a>"; 
} 
else { 
  //Gives and error if its not 
  echo "Sorry, there was a problem uploading your file."; 
} 

此代码仅适用于一张图像(将一张图像名称上传到数据库字段 -photo)，并且仅当我将插入更改为更新时才有效。如何使其适用于多个图像和插入命令？

Answer 1

查看变量的索引和名称。您使用 $_FILES['uploadedfile']['name1'] 和 $_FILES['photo1']['tmp_name']。您确定这是正确的吗？ POST 数据位于 $_POST 数组中，文件信息位于 $_FILES 中。上传文件的名称位于 $_FILES['photo1']['name'] 中。您永远不会设置 $_FILES['uploadedfile']['name1']。

另外，你有什么表结构？您有两个名称字段和两个文件路径字段吗？

您的查询不正确。如果要更新表行，请使用 UPDATE ... WHERE ... 查询。如果您想添加新的，请使用 INSERT，而不使用 WHERE。您评论了正确的一条。

此外，确实使用 PDO 和准备好的语句。您的代码允许 SQL 注入(inject)。