php - 以一种形式上传文本和图像，使用 PHP 将路径和文本存储在数据库中

Question

上周我一直在研究这段代码，这让我绞尽脑汁。我在高低的论坛上进行了搜索，但在这个特定主题上只能找到很少的内容。

我想使用表单来上传文本和图像。图像被上传到目录 (upload/)，而图像路径和文本被插入到数据库表中 (upgrade.Testimonials)。索引、上传器 php 和上传文件夹都存在于 www.mywebsite.com/testimonials

执行表格后，我收到“已连接到 $ftp_server，为用户 $USERNAME SAVED
存储在:upload/"但没有上传照片，并且存储在 DB 中的路径没有标题。但所有其他信息都已提交到数据库。

我已经在 TextWrangler 中打开了 file_upload.php，它没有给我任何错误。与 Godaddy 一起托管。

除了 NY 对 SQL 注入(inject)的主要漏洞之外，
为什么我不能上传图片!？

这是我到目前为止所拥有的，请帮助!

file_upload.php

       <?php
if(isset($_POST['add']))
{
$dbhost = '';
$dbuser = '';
$dbpass = '';
$db_name = 'upgrade';
$tbl_name = 'Testimonials';
$ftp_user = '';
$ftp_pass = '';
$conn = mysql_connect($dbhost, $dbuser, $dbpass);
if(! $conn )
{
  die('Could not connect: ' . mysql_error());
}
mysql_select_db("$db_name")or die("cannot select DB");


$ftp_server = "";
$ftp_conn = ftp_connect($ftp_server) or die("Could not connect to $ftp_server");
// login with username and password
$login_result = ftp_login($ftp_conn, $ftp_user, $ftp_pass);


// check connection
if ((!$ftp_conn) || (!$login_result)) {
       echo "FTP connection has failed!";
       echo "Attempted to connect to $ftp_server for user $ftp_user";
       exit;
   } else {
       echo "Connected to $ftp_server, for user $ftp_user";
 }


$Fname = $_POST['fname'];
$Email = $_POST['email'];
$Content = $_POST['content'];
$filePath="http://www.mywebsite.com/testimonials/upload/" . $_FILES["file"]["name"];
$Type = $_POST['type'];

 if ($_FILES["file"]["error"] > 0)
  {
     echo "Error: NO CHOSEN FILE <br />";
     echo"INSERT TO DATABASE FAILED";
   }
   else
   {
     move_uploaded_file($_FILES["file"]["tmp_name"], __DIR__ . "/upload/" . $_FILES["file"]["name"]);
     echo"SAVED<br>";



$query_image = "INSERT INTO $tbl_name (fname, email, content, image,type, submission_date) VALUES ('$Fname','$Email','$Content','$filePath','$Type',curdate())";
if(mysql_query($query_image))
{
echo "Stored in: " . "upload/" . $_FILES["file"]["name"];
}
else
{
echo 'File name not stored in database';
}
}
}



?>

The Form from INDEX.php

<form method="post"  enctype="multipart/form-data" action="/testimonials/file_upload.php">
<table>
<tr>
<td width="250">Name</td>
<td>
<input name="fname" type="text" id="fname" /><br />
</td>
</tr>
<tr>
<td width="250">Email: (will not be publicized)</td>
<td>
<input name="email" type="text" id="email" /><br />
</td>
</tr>
<tr>
<td width="250">Client Type</td>
<td id="mainselection">
<select name="type" id="type">
    <option></option>
    <option value="Residential">Residential</option>
    <option value="Business">Business</option>

</select>
</td>
</tr>
<tr>
<td width="250">Comments</td>
<td>
<textarea id="content" name="content" rows="10" cols="50" style="border-style:groove;box-shadow: 4px 4px 4px 4px #888888;"placeholder="Please describe your experience"></textarea>
</td>
</tr>
<tr>
<td width="250">Image</td>
<td>
<input name="image" type="file" id="file">
</td>
</tr>

<tr>
<td width="250"> </td>
<td>
<input name="add" type="submit" id="add" value="Add Testimonial">
</td>
</tr>
</table>
</form>

Answer 1

解决了:
以下是工作代码；将文件/图像上传到 ftp 目录，将路径存储在数据库表中，存储当前日期和表单中的文本 ALL FROM ONE FORM。

我在网上搜索了数周，寻找一种简洁的方法来同时在数据库中的一行上提交所有这些信息。只能拼凑起来，给大家。

对新手而言:
1)在您的 html daw 中创建 2 个文件。 Index.php 和 file_upload.php。索引将是您放置 html 的位置，file_upload.php 文件是您添加 php 代码的位置。 php 文件通常以

ID 行必须设置为主键和 INT。其余的应设置为具有特定数量的字符(您选择)的 Varchar。

4) 在 index.php 和 file_upload.php 的相同位置创建上传文件夹。确保并添加文件权限到上传文件夹以禁止或允许公共(public)编辑。

5) 关掉'http://www.yourwebsite.com/directory ' 在我的代码中包含您的网站和页面目录。

在下面的例子中，upgrade 是数据库名，Testimonials 是表名。

file_upload.php

<?php
if(isset($_POST['add']))
{
$dbhost = '';
$dbuser = '';
$dbpass = '';
$db_name = 'upgrade';
$tbl_name = 'Testimonials';
$ftp_user = '';
$ftp_pass = '';
$ftp_server = "";

$conn = mysql_connect($dbhost, $dbuser, $dbpass);
if(! $conn )
{
  die('Could not connect: ' . mysql_error());
}
mysql_select_db("$db_name")or die("cannot select DB");




$ftp_conn = ftp_connect($ftp_server) or die("Could not connect to $ftp_server");
// login with username and password
$login_result = ftp_login($ftp_conn, $ftp_user, $ftp_pass);


// check connection
if ((!$ftp_conn) || (!$login_result)) {
       echo "FTP connection has failed!";
       echo "Attempted to connect to $ftp_server for user $ftp_user";
       exit;
   } else {
       echo "Connected to $ftp_server, for user $ftp_user";
   }


$Fname = $_POST['fname'];
$Email = $_POST['email'];
$Content = $_POST['content'];
$Type = $_POST['type'];
$uploadDir = 'http://www.yourwebsite.com/directory/'.'upload/'; 
$fileName = $_FILES['image']['name'];
$filePath = $uploadDir . $fileName;

if(move_uploaded_file($_FILES["image"]["tmp_name"],"upload/".$_FILES["image"]["name"]))
{
// If file has uploaded successfully, store its name in data base
$query_image = "INSERT INTO $tbl_name(fname,email,content,image,type,submission_date) VALUES ('$Fname','$Email','$Content','$filePath','$Type',curdate())";
if(mysql_query($query_image))
{
echo "Stored in: " . "upload/" . $_FILES["image"]["name"];
}
else
{
echo 'File name not stored in database';
}
}
else{echo 'File not uploaded';}

}





?>

THE FORM

<form method="post"  enctype="multipart/form-data" action="/testimonials/file_upload.php">
<table>
<tr>
<td width="250">Name</td>
<td>
<input name="fname" type="text" id="fname" /><br />
</td>
</tr>
<tr>
<td width="250">Email: (will not be publicized)</td>
<td>
<input name="email" type="text" id="email" /><br />
</td>
</tr>
<tr>
<td width="250">Client Type</td>
<td id="mainselection">
<select name="type" id="type">
    <option></option>
    <option value="Residential">Residential</option>
    <option value="Business">Business</option>

</select>
</td>
</tr>
<tr>
<td width="250">Comments</td>
<td>
<textarea id="content" name="content" rows="10" cols="50" style="border-style:groove;box-shadow: 4px 4px 4px 4px #888888;"placeholder="Please describe your experience"></textarea>
</td>
</tr>
<tr>
<td width="250">Image</td>
<td>
<input name="image" type="file" id="file">
</td>
</tr>

<tr>
<td width="250"> </td>
<td>
<input name="add" type="submit" id="add" value="Add Testimonial">
</td>
</tr>
</table>
</form>

感谢@engvrdr