uploadify and sql query

Question

Hello,

i am using uploadify script to upload files as my school project.

//die($_SESSION['ID'].'.....'.$_SESSION['level']);

if (!empty($_FILES)) {
    $tempFile = $_FILES['Filedata']['tmp_name'];
    $targetPath = $_SERVER['DOCUMENT_ROOT'] . $_REQUEST['folder'] . '/';
    $filename = substr(md5(time()), 0, 8)."-".$_FILES['Filedata']['name'];
    $targetFile =  str_replace('//','/',$targetPath) . $filename;
    $time = time();
    $ID = $_SESSION['ID'];

    $sql = mysql_query("INSERT INTO files VALUES(NULL, '$ID', '$targetFile', '$time')");

    move_uploaded_file($tempFile,$targetFile);
    echo "1";
}

On top $_SESSION['id'] is working, however when i entered inside $sql, it return as 0. Any idea why? i have rechecked everything.

Confused.

Thank you

Answer 1

Must be the type of your mysql column.

Be sure your are using varchar/text because '$ID' is a string : if your type is int (or similar) then you WILL have 0 inserted.

Answer 2

Couple things wrong here. You should first be explicitly naming your fields in the $sql:

$sql = 'insert into tablename (fileid,filename,d_uploaded) values ('.$ID.', \''.$targetFile.'\', '.$time.');';

Most ID fields won't be VARCHAR they will be INT. All VARCHAR is a text field and all INT are numeric. You don't escape out your INT fields but you need to escape your VARCHAR.

Also don't insert NULL fields to get an auto increment field. By doing the SQL the way I have above you get the benefit of being able to only code the SQL fields you are inserting and the rest of the fields in the table will insert default values.

Answer 3

Try using INSERT INTO files SET field=value, field=value, .. and remember to sanitize user input (like $_REQUEST) using mysql_real_escape_string() (and if you have magic quotes enabled to disable them if you decide to use mysql_real_escape_string().

Answer 4

It seems SESSION doesn't work well with uploadify, i solved it with scriptData uploadify.

Thank you for all answers.