HTTP Error 405 on localhost with phpMyAdmin - php

I just started learning PHP, and I wanted to see if I could make a form where the information would be stored in a database. To do this I am using phpMyAdmin. The problem occurs when I press the "Submit" button. I get an error that states the site is not working due to an HTTPS 405 error. Any help or guidance would be appreciated. Thankyou.
HTML
<!DOCTYPE html>
<html>
<!-- Head -->
<head>
<title></title>
</head>
<!-- Body -->
<body>
<h1 id="title">Info Form</h1>
<form action="info.php" method="POST">
<section id="firstName">
First Name:
<input type="text" placeholder="First Name" name="userFirstName" required>
<br><br>
</section>
<section id="lastName">
Last Name:
<input type="text" placeholder="Last Name" name="userLastName" required>
<br><br>
</section>
<section id="genderChoice">
Male:
<input type="radio" name="userGender" value="m" required>
Female:
<input type="radio" name="userGender" value="f" required>
<br><br>
</section>
<section id="submit">
<input type="submit" value="Submit">
</section>
</form>
</body>
</html>
PHP
$userFirstName = $_POST['userFirstName']; $userLastName = $_POST['userLastName']; $userGender = $_POST['userGender'];
$host = "127.0.0.1"; $dpUsername = "root"; $dpPassword = ""; $dpname = "form";
$conn = new mysqli($host, $dpUsername, $dpPassword, $dpname);
$INSERT = "INSERT Into info (userFirstName, userLastName, userGender) values($userFirstName, $userLastName, $userGender)";

Related

Insert value of multiple checkbox in sqlite database using php pdo

Hi I have multiple check boxes name make and female I want that if a person select make and don't select female it input nothing or false in database now if I don't select example: female it return nothing in female row but it also get a error
Undefined index: Female in /storage/sdcard1/www/3/signup/index.php on line 11
but I don't want this error and I want the if female not select it insert false and don't show error I don't want the selected check box value to be true because it is wrote as on in database
Code index.php
<?php
if(isset($_POST['submit'])){
$conn = new PDO("sqlite: sign.db");
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$Email = $_POST['Email'];
$First = $_POST['First'];
$Last = $_POST['Last'];
$Password = $_POST['Password'];
$Male = $_POST['Male'];
$Female =$_POST['Female'];
$Dateofb = $_POST['Dateofb'];
require_once 'imp.php';
}
?>
<!DOCTYPE html>
<html>
<head>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<link rel="stylesheet" href="index.css" >
<script src="index.js" ></script>
<title>Survey</title>
</head>
<body>
<form action="" method="post" >
<div class="container" >
<div class="form" >
<input type="email" class="first" id="Email" name="Email" placeholder="Email" required="required">
<input type="text" class="second" id="First" name="First" placeholder="First name" required="required">
<input type="text" class="last" id="Last" name="Last" placeholder="Last name" required="required">
<input type="password" class="pass" name="Password" id="Password" placeholder="Password" required="required">
<div class="day" >
<p class="bd" >Birthday Date:</p>
<input type="date" class="date" id="Dateofb" name="Dateofb" >
</div>
<div>
<div class="malee" >
<input type="checkbox" class="male" id="Male" name="Male">
<p class="mal" >Male</p>
</div>
<div class="femalee" >
<input type="checkbox" class="female" id="Female" name="Female" >
<p class="fem" >Female</p>
</div>
</div>
<div >
<input class="submit" id="submit" type="submit" name="submit" >
</div>
<div class="acc" >
already have account <a href="#" >Login</a>
</div></div>
</div>
</form>
</body>
</html>
Code imp.php
<?php
$sql = "INSERT INTO signup (`Email`, `First`, `Last`, `Password`, `Male`, `Female`, `Dateofb`) VALUES ('$Email', '$First', '$Last', '$Password', '$Male', '$Female', '$Dateofb');";
// use exec() because no results are returned
$conn->exec($sql);
echo "New record created successfully";
$conn->connection = null;
?>
The problem is that only checked boxes are submitted.
You need to check if a box's name is set in $_POST and IF NOT:
manually assign a value you wish to use instead
I.e. use this short hand if/else
$Female = (isset ($_POST['Female'])) ? 1 : 0;

HTML Form + PHP + MYSQL 500 Error

I am receiving an internal 500 error when trying to insert data from HTML form into MySQL database via PHP. I am hosting a site with an Apache 2 webserver on an Ubuntu server (droplet using DigitalOcean). PHP and MySQL are both installed on the server. HTML below and PHP below. I have tested with a PHP echo with the variable $name, which was successful, but I am thrown the error whenever I try to connect to mysql. I know 500 is an internal error, but am not sure where to go from here.
<!DOCTYPE html>
<html>
<meta name="viewport" content="width=device-width, initial-scale=1">
<head>
<title>who this</title>
<link rel="stylesheet" type="text/css" href="STYLE.css">
</head>
<body>
<h1 id="header2">me</ h1>
<div id="back">
back
</div>
<div id="me-intro">
<p>tell me about yourself</p>
</div>
<div id="joke">
<form action="process.php" method="POST">
<div id="one">
<p>name: <input type="text" name="name" id='first'></p>
</div>
<div id="two">
<p>gender: <input type="text" name="gender" id='second'></p>
</div>
<div id="three">
<p>age: <input type="text" name = "age" id='third'></p>
</div>
<div id="four">
<p>occupation: <input type="text" name="occupation" id='fourth'></p>
</div>
<div id="five">
<p>education: <input type="text" name="education" id='fifth'></p>
</div>
<div id="six">
<p>car you drive: <input type="text" name="car" id='sixth'></p>
</div>
<div id="seven">
<p>phone number: <input type="text" name="phone" id="seventh"></p>
</div>
<div id="eight">
<p>address: <input type="text" name="address" id="eighth"></p>
</div>
<div id="nine">
<p>social security number: <input type="text" name="ssn" id="ninth">
</div>
<div id="ten">
<input type="submit">
</div>
</form>
</div>
</body>
</html>
process.php below
<?php
$conn = new mysqli("localhost", "root", "password_here", "database_here");
$name = $_POST["name"];
$gender = $_POST["gender"];
$age = $_POST["age"];
$occupation = $_POST["occupation"];
$education = $_POST["education"];
$car = $_POST["car"];
$phone = $_POST["phone"];
$address = $_POST["address"];
$ssn = $_POST["ssn"];
if($conn -> connect_error) {
die("err: dis not working: " . $conn->connect_error);
}
$sql = "INSERT INTO table_here (name, gender, age, occupation, education, car, phone, address, ssn) VALUES ('$name', '$gender', '$age', '$occupation', '$education', '$car', '$phone', '$address', '$ssn')";
if($conn->query($sql) === TRUE){
echo "success";
} else {
echo "error: did not submit form to mysql";
}
$conn->close();
?>

HTML data submit button returns php source file and does not send data to mysql table

Installed Apache2 and uncommented php7 module with: https://websitebeaver.com/set-up-localhost-on-macos-high-sierra-apache-mysql-and-php-7-with-sslhttps
Location of apache config in my machine:
/etc/apache2
Installed MySQl with homebrew according to : https://tecadmin.net/install-mysql-macos/#
Locations of MySQl on my machine is:
mysql is /usr/local/bin/mysql
mysql is /usr/local/mysql/bin/mysql
Wrote unique mysql tables under same database for two unique html registration forms written on Visual Studio Code. Live server extension on VS Code allows browser to display and navigate html/css but after I submit data on signup.html, my interpreters.php code is automatically returned as a download with unknown server script injection.
signup.html file displays on browser
!DOCTYPE html>
<html>
<head>
<link rel="stylesheet" type="text/css" href="signup.css">
<link rel="stylesheet" type="text/css" href="navigationbar.css">
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Sign up with ...</title>
</head>
<header>
<div id="menu-content">
<div class="navbar">
<ol>
<li> Home </li>
<li> For Professionals </li>
<li> Request Service </li>
</ol>
</div>
</div>
</header>
<body>
<form name="signup" action="interpreters.php" method="get" style="border:1px solid #ffff">
<div class="container">
<h1><center>Professional Interpreter Registration</center></h1>
<label for="first">First Name: </label>
<input type="text" placeholder="Your name..." name="first" required>
<label for="last">Last Name:</label>
<input type="text" placeholder="Your last name..." name="last" required>
<label for="industry"><b> Industry: </b></label>
<input type="text" placeholder="Your industry..." name="industry" required>
<label for="type"><b> Service Type: </b></label>
<input type="text" placeholder="Description:Translation of legal documents Mandarin and Arabic/Interpret Italian through video only." name="industry" required>
<label for="email">Email:</label>
<input type="text" placeholder="email" name="email" required>
<div class="clearfix">
<button type="submit" class="signupbtn name="submit">Sign Up</button>
</div>
</div>
</form>
</body>
</html>
The action that the html is linked to is the following interpreters.php
<?php
// php code to Insert data into mysql database from input text
if(isset($_GET ['insert'] ) )
{
$hostname = "localhost";
$username = "root";
$password = "......";
$databaseName = "registrations";
// get values form input text and number
$last = $_GET ['last'];
$first = $_GET['lfirst'];
$industry = $_GET['industry'];
$type = $_GET['type'];
$email = $_GET['email'];
// connect to mysql database using mysqli
$connect = mysqli_connect($hostname, $username, $password, $databaseName);
// mysql query to insert data
$query = "INSERT INTO `interpreters`(`last`, `first`, `industry`, 'type', 'email') VALUES ('$last','$first','$industry', '$type', '$email' )";
$result = mysqli_query($connect,$query);
// check if mysql query successful
if($result)
{
echo 'Data Inserted';
}
else
{
echo 'Data Not Inserted';
}
mysqli_free_result($result);
mysqli_close($connect);
}
?>
<html>
<body>
Thank you, <?php echo $_POST['first']; ?><br />
We will contact you at <?php echo $_POST['email']; ?><br />
<br />
</body>
</html>

HTML Form Search Function via PHP MYSQL lookup

I am quite new to HTML/PHP code.
I am trying to build a form that will search a MySQL database based on a key value (Vehicle VRN) being provided. As it stands I have sorted the submit code and I am able to add a new customer to the Customers database by clicking 'Submit New'
However, I cannot get the search function to work e.g. enter the vehicle VRN and fill in the rest of the form with that customers information
Here's the HTML form:
<!DOCTYPE HTML>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>ABC Autorite Ltd</title>
<link rel="stylesheet" href="style/style.css" type="text/css" media="screen" />
<script type="text/javascript" src="style/accordian.pack.js"></script>
</head>
<body onload="new Accordian('basic-accordian',5,'header_highlight');">
<div id="logo"><h1>ABC Autorite</h1></div>
<div id="basic-accordian" >
<div id="test-header" class="accordion_headings header_highlight">Customers</div>
<div id="test-content">
<div class="accordion_child">
<h1>Search customer database or submit new details</h1>
<div class="form_layout">
<form method="post" id="Customer">
<select name="title">
<option>Mr.</option>
<option>Dr.</option>
<option>Ms.</option>
<option>Mrs.</option>
</select>
<input type="text" name="first_name" placeholder="First Name" value="<?php echo $first_name; ?>">
<input type="text" name="last_name" placeholder="Last Name">
<input type="text" name="phone_number" placeholder="Phone">
<input type="text" name="email_address" placeholder="Email Address">
<input type="text" name="address_line_1" placeholder="Address">
<input type="text" name="postcode" placeholder="Postcode">
<input type="text" name="vrn" placeholder="VRN">
<input type="text" name="make" placeholder="Make">
<input type="text" name="model" placeholder="Model">
<input type="text" name="year" placeholder="Year">
<div class="form_buttons">
<input type="submit" name="search" Value="Search" onclick="form.action='search.php';"/>
<input type="submit" name="submit" Value="Submit New" onclick="form.action='submit.php';"/>
</div>
</form>
</div>
</div></div>
<div id="test1-header" class="accordion_headings">New Job Card</div>
<div id="test1-content">
<div class="accordion_child">
<h1>Create a new Job Card</h1>
</div>
</div>
<div id="test2-header" class="accordion_headings">Job Cards</div>
<div id="test2-content">
<div class="accordion_child">
<h1>Search for a previous Job Card</h1>
</div>
</div>
</div>
</div>
<div id="footer">
<p>Copyright ABC Autorite Ltd</p>
</div>
</body>
</html>
Here's the PHP search script:
<?php
$servername="192.168.0.8";
$username="my_admin";
$password="my_password";
$dbname="ABCAUTORITE";
// Opens a connection to a MySQL server
$connection=mysql_connect ($servername, $username, $password);
if (!$connection) { die('Not connected : ' . mysql_error());}
// Set the active MySQL database
$db_selected = mysql_select_db($dbname, $connection);
if (!$db_selected) {
die ('Can\'t use db : ' . mysql_error());
}
$vrn = $_POST['vrn'];
$sql = mysql_query("SELECT * FROM Customers WHERE vrn like '%$vrn%'");
while($row = mysql_fetch_array($sql))
{
echo $row['first_name'];
echo $row['last_name'];
}
?>
I am just returning first_name and last_name for now as a 'test' before I add the rest of the values.
This has caused me a few hours of head scratching so I am on here looking for any help.
Thanks.
You can separate a form by checking to see what $_POST[] variable isset
<?php # customer.php
if(isset($_POST['search'])){
echo 'pressed the search button.';
while($row = mysql_fetch_assoc($sql)){
$form[] = '<input type="text" name="first_name" value="'.$row['first_name'].'">';
$form[] = '<input type="text" name="last_name" value="'.$row['last_name'].'">';
// etc
}
} elseif(isset($_POST['submit'])){
# execute code to submit user.
} else {
# render the form normally.
$form[] = '<input type="text" name="first_name" placeholder="First Name" value="">';
$form[] = '<input type="text" name="last_name" placeholder="Last Name" value="">';
// etc.
}
?>
And just use a standard form.
<!-- Still in customer.php -->
<form method="post" id="Customer" action="./customer.php">
<?php
foreach($form as $v){
echo $v;
}
?>
<div class="form_buttons">
<input type="submit" name="search" Value="Search" />
<input type="submit" name="submit" Value="Submit New" />
</div>
</form>
And now your question:
To do with PHP and HTML alone, you would need to do everything in 1 page meaning you would need to generate the form with your desired values.
Okay.. you don't have to if you don't want to but I would really recommend it. This way your code is together and not split apart.
Now there's a million ways to code this, I just picked one that you might be able to easily understand.
There is an alternative
A combination of Javascript and PHP. Use Javascript (I would really recommend jQuery) to request a single php file on the server and let it return a json format object. Then use jQuery to update your already rendered form.
On a side note..
Switch over to PDO for your database to allow for binding your post data to your prepared statement. Currently your code is open to SQL injection.

Uploading file to MySQL blob field file_get_contents(): failed (from input type="file")

I am uploading a file from my local directory to a MySQL Databases' MEDIUMBLOB field using file_get_contents and I am receiving the following error:
Warning: file_get_contents(test.txt): failed to open stream: No such file or directory in C:\xampp\htdocs\Craisins\forms\new_scenario.php on line 265
Yet the file is definitely there since I pick it with input type="file"
This seemed to be working yesterday and now suddenly today it's no longer working correctly and I'm not sure why.
Here is the full file:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<!--Normal CSS Sheets-->
<link rel="stylesheet" type="text/css" href="../includes/style.css">
<link rel="stylesheet" type="text/css" href="../includes/style_form.css">
<!--BSM Select CSS Sheet-->
<link rel="stylesheet" type="text/css" href="../includes/bsmselect/css/jquery.bsmselect.css">
<!--jQuery-->
<script src="../includes/jquery-2.1.4.min.js"></script>
<!--jQuery for BSMSelect-->
<script src="../includes/bsmselect/js/jquery.bsmselect.js"></script>
<!--jQuery selector for BSMSelect-->
<script>
$(document).ready(function() {
$("select[multiple]").bsmSelect();
});
</script>
<style type="text/css">
<!--
.style1
{
font-size: 12px;
font-weight: bold;
}
textarea
{
resize: none;
}
-->
<?php include ("../includes/formSuccess.php");
include ("../includes/sql.php");
require_once "../WindowsAzure/WindowsAzure.php";
use WindowsAzure\Common\ServicesBuilder;
use WindowsAzure\Blob\Models\CreateContainerOptions;
use WindowsAzure\Blob\Models\PublicAccessType;
use WindowsAzure\Common\ServiceException;
?>
</style>
<title>****</title>
</head>
<body>
<div id="pageContainer">
<!--This section is for the upper half of the page. From the "Title" bar up.-->
<?php include ("../includes/formNav.php");?>
<!--End of the Header Section-->
<br>
<!--This section is where we add the main content for the page.-->
<div id="contentArea">
<div id="mainContentAdmin">
<h1 style="text-align:center">Add New Scenario</h1>
<?php
// display form if user has not clicked submit
if (!isset($_POST["btn_submit"]))
{
?>
<!--This will be the form that will hold the information of the entire page.-->
<form class="elegant-aero" action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
<p>
<!--Scenario Title-->
<label>
<span>Title:</span>
<input type="text" name="title" placeholder="Enter the full scenario name here">
</label>
<!--Scenario Description-->
<label>
<span>Description:</span>
<textarea name="desc" placeholder="Enter the scenario description here"></textarea>
</label>
<!--Scenario Times-->
<label id="time">
<span>Estimated Times:</span>
<!--Scenario Execution Time-->
<b>Execution:</b>
<input type="number" name="execHr" min="0" placeholder="Hours">
<input type="number" name="execMin" min="1" placeholder="Minutes">
<br><br>
<!--Scenario Debriefing Time-->
<b>Debriefing:</b>
<input type="number" name="debriHr" min="0" placeholder="Hours">
<input type="number" name="debriMin" min="0" placeholder="Minutes">
</label>
<br>
<!--Origin-->
<label>
<span>Origin:</span>
<input type="text" name="origin" placeholder="Enter the origin here (if any)">
</label>
<!--Target Users-->
<label>
<span>Target Users:</span>
<select name="users[]" multiple="multiple" title="Please select user type...">
<?php
selectMySQL("valid_trainee_type","trainee_type");
?>
</select>
</label>
<br>
<!--Capabilities-->
<label>
<span style="">Capabilities Required:</span>
<select name="capabilities[]" multiple="multiple" title="Please select capabilities...">
<?php
selectMySQL("valid_capability","name");
?>
</select>
</label>
<br>
<!--Prerequisites-->
<label>
<span style="">Prerequisite Knowledge:</span>
<select name="prerequisites[]" multiple="multiple" title="Please select prerequisites...">
<?php
selectMySQL("valid_prerequisite","prerequisite");
?>
</select>
</label>
<br>
<!--Equipment-->
<label>
<span>Equipment Required:</span>
<select name="equipment[]" multiple="multiple" title="Please select equipment...">
<?php
selectMySQL("valid_equipment","equipment");
?>
</select>
</label>
<!--Parameters-->
<label>
<span>Parameters to Monitor:</span>
<select name="parameters[]" multiple="multiple" title="Please select parameters...">
<?php
selectMySQL("valid_parameter","parameter");
?>
</select>
</label>
<br>
<!--Learning Objectives-->
<label>
<span>Learning Objectives:</span>
<textarea name="object" placeholder="Please list the learning objectives for the procedure..."></textarea>
</label>
<!--Setting-->
<label>
<span>Setting:</span>
<textarea name="set" placeholder="Please describe the ideal setting for the procedure..."></textarea>
</label>
<!--Preparation-->
<label>
<span>Preparation Required:</span>
<textarea name="prep" placeholder="Please list any steps that are required in order to perform this procedure..."></textarea>
</label>
<!--Participants-->
<label>
<span>Participants Required:</span>
<textarea name="part" placeholder="Please list the participants that will be required in order to perform this procedure..."></textarea>
</label>
<!--Patient Information-->
<label>
<span id="patient">Patient Information:</span>
<br>
<!--Patient Name-->
<b>Name</b>
<input type="text" name="patName" style="width:63%;" placeholder="Enter the patient's full name here">
<!--Patient Vitals-->
<b>Vitals</b>
<select name="patSex" style="width:15%;" title="Male or Female?">
<option value="male">male</option>
<option value="female">female</option>
</select>
<b>Age</b>
<input name="patAge" type="text" style="width:5%;">
<b>Height</b>
<input type="text" name="patHt" style="width:6%;" placeholder="(in)">
<b>Weight</b>
<input type="text" name="patWt" style="width:6%;" placeholder="(lbs)">
<span style="width: 30%; border-right:0; margin-right:0; padding-right: 5px;">Other Info</span>
<textarea style="width:63%;" name="patInfo" placeholder="Any other medical details?"></textarea>
</label>
<!--Scoring-->
<label>
<span>Scoring:</span>
<textarea name="score" placeholder="Please detail the scoring rubric for this scenario..."></textarea>
</label>
<!--Debrief-->
<label>
<span>Debrief:</span>
<textarea name="debrief" placeholder="Please detail the debriefing process for this scenario..."></textarea>
</label>
<!--Scenario File-->
<label>
<span>Scenario Details:</span>
<br>
<input type="file" name="fileScenDetails" value="Upload File">
<br>
<textarea name="textScenDetails" placeholder="Please any other scenario details here..."></textarea>
</label>
<!--Submit Button-->
<label>
<span> </span>
<input type="submit" name="btn_submit" class="button" value="Add Scenario"/>
</label>
</p>
</form>
<?php
} //end if
else
{
//Setup the MySQL server
$servername = "localhost";
$username = "root";
$password = "****";
$dbname = "****";
//Create connection to the MySQL server
$conn = new mysqli($servername, $username, $password, $dbname);
//Check connection
if($conn -> connect_error)
{
die("Connection failed: " . $conn -> connect_error);
} //end if
//Organize Execution Time
$exec_time = "00:".$_POST['execHr'].":".$_POST['execMin'];
//Organize Debriefing Time
$debrif_time = "00:".$_POST['debriHr'].":".$_POST['debriMin'];
//Organize BLOB
$blob = addslashes(file_get_contents($_POST['fileScenDetails']));
$sql="INSERT INTO scenario (title, description, est_scenario_time, est_debriefing_time,
origin, objectives, setting, preparation, participants,
patient_name, patient_sex, patient_age, patient_height,
patient_weight, patient_info, scoring, debrief,
scenario_file, scenario_text)
VALUES ('".$_POST['title']."','".$_POST['desc']."', '$exec_time', '$debrif_time',
'".$_POST['origin']."','".$_POST['object']."',
'".$_POST['set']."','".$_POST['prep']."',
'".$_POST['part']."','".$_POST['patName']."',
'".$_POST['patSex']."','".$_POST['patAge']."',
'".$_POST['patHt']."','".$_POST['patWt']."',
'".$_POST['patInfo']."','".$_POST['score']."',
'".$_POST['debrief']."','$blob',
'".$_POST['textScenDetails']."');";
if($conn->query($sql) === TRUE) {
} else {
echo "Error: " . $sql . "<br>" . $conn->error;
} //end else
$conn->close();
/*
//Insert Target Users (Trainee Types)
insert_Scen_Dev('scenario','title', 'title','users',
'valid_trainee_type','trainee_type', 'scenario_trainee_type',
'scenario_id', 'valid_trainee_type_id');
//Insert Capabilities
insert_Scen_Dev('scenario','title', 'title','capabilities',
'valid_capability','name', 'scenario_capabilities',
'scenario_id', 'valid_capability_id');
//Insert Prerequisites
insert_Scen_Dev('scenario','title', 'title','prerequisites',
'valid_prerequisite','prerequisite', 'scenario_prerequisites',
'scenario_id', 'valid_prerequisite_id');
//Insert Equipment
insert_Scen_Dev('scenario','title', 'title','equipment',
'valid_equipment','equipment', 'scenario_equipment',
'scenario_id', 'valid_equipment_id');
//Insert Parameters
insert_Scen_Dev('scenario','title', 'title','parameters',
'valid_parameter','parameter', 'scenario_parameters',
'scenario_id', 'valid_parameter_id');
*/
echo "<div class='sqlSuccess'>A new Scenario has been added!</div>";
} //end else
?>
</div>
</div>
<!--End of the Content Section-->
<!--This section is for the lower half of the page. From the copyright bar down.-->
<div id="footer">
<div id="footerCenter">
Copyright ©
<script language="javascript" type="text/javascript">
var today = new Date();
var year = today.getFullYear();
document.write(year);
</script>
</div>
</div>
<!--End of the Footer Section-->
</div>
</body>
There are several problems with this code. At first, file won't upload unless you specify a correct enctype attribute on a form element:
<form enctype="multipart/form-data" action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
Also the file address is available under $_FILES['fileScenDetails']['tmp_name'], not under $_POST['fileScenDetails'], so:
$blob = addslashes(file_get_contents($_FILES['fileScenDetails']['tmp_name']));
Note, that you should check if file upload was successfull, as otherwise your code will trigger warning (eg. when user won't specify file). Add something like this:
if(isset($_FILES['fileScenDetails']['error']) && UPLOAD_ERR_OK == $_FILES['fileScenDetails']['error']) {
// do your stuff here
} else {
// display 'no-file' error to the user
}
Also, you should definitely check if the specified file was really uploaded, to avoid stealing your code with malformed requests. Check is_uploaded_file function here: http://php.net/manual/en/function.is-uploaded-file.php
There are also some possible SQL injections and other security issues.

Categories