PHP PHP PDO upload image to DB

[JasonL]

Hi,

I am using PHP with PDO to connect DB.
$pdo = pdo_connect_mysql();

How to edit below code to connect DB?
if(ISSET($_POST['upload'])){
$file_name = $_FILES['file']['name'];
$file_temp = $_FILES['file']['tmp_name'];
$file_size = $_FILES['file']['size'];
$file_type = $_FILES['file']['type'];
$date_uploaded=date("Y-m-d");
$location="upload/".$file_name;
if($file_size < 5242880){
if(move_uploaded_file($file_temp, $location)){
try{
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$sql = "INSERT INTO `file`(file_name, file_type, date_uploaded, location) VALUES ('$file_name', '$file_type', '$date_uploaded', '$location')";
$conn->exec($sql);
}catch(PDOException $e){
echo $e->getMessage();
}

$conn = null;
header('location: index.php');
}
</center>";
}
}

 

[Malcolm]

Hello @JasonL,

Welcome to Code Forum!

Could you please edit your thread and format your code into our BBCode feature (</>).

 

[LTomy]

Hi JasonL,
Welcome here!

If you use MySQL, you connect to it like such:

$conn = new PDO("mysql:host=$serverAddress;dbname=$dataBaseName;charset=utf8", $username, $password);

If it is PostgreSQL, like that:

$conn = new PDO("pgsql:host=$serverAddress;dbname=$dataBaseName;charset=utf8", $username, $password);

 

[Ghost]

I want to reply in full shortly, but for starters...
SANITIZE your data!! You need to make sure you check what type of file it is too - by extension or raw meta data for file type.

I highly recommend using some prepared queries... You can learn how to write a PHP prepared statement / query with my tool I made to help construct the code for beginners:

https://prosql.org/QueryPro/index.php?query_type=prepared_insert

You should also be checking if the size is over 0 because an empty file upload will fail.

Also you need to make sure you check if file_exists() or not so you don't fail to save a file or overwrite it, etc.

I recommend doing like:
while($filename = md5(rand(0,10000)) && !file_exists($location . $filename . $fileextension){ code to save file here }

... or something similar. This of course would only support 10,000 total uploads, so using a different algorithm for filenames is advised if you have a big project in mind!


-------
Is there a specific error you are trying to fix?