Uploading Multiple CSV into mysql using PHP - php

Question

I got this code for importing multiple csv file into database but when i tried to upload only one file is being uploaded. I tried many things but just couldn't find a way.
<form name="import" method="post" enctype="multipart/form-data">
<div class="col-lg-6 col-xs-6">
<input type="file" name="file[]" multiple /><br />
</div><!-- ./col -->
<input type="submit" class="form-control"name="submit" value="Submit" />
</form>
<?php
include ("connection.php");
if(isset($_POST["submit"]))
{
$file = $_FILES['file']['tmp_name'];
$handle = fopen($file, "r");
$c = 0;
fgetcsv($handle);
while(($filesop = fgetcsv($handle, 10000, ",")) !== false)
{
$ITEM_CODE_MX =$filesop[1];
$addqtyqry = mysqli_query($link,"INSERT INTO salesreceiptlinedetail
(ItemRef_FullName)
VALUES ('".$ITEM_CODE_MX."')");
$c = $c + 1;
}
}
?>

Answer 1

You are allowing multiple files so you need to loop over these multiple file references in the $_FILES array.
Your script was also open to SQL Injection Attack
Even if you are escaping inputs, its not safe!
So I used a prepared and parameterised query prepared parameterized statements
Preparing the statement once and executing it multiple times is one of the ways you can leverage prepared statements to save you execution time.
<form name="import" method="post" enctype="multipart/form-data">
<div class="col-lg-6 col-xs-6">
<input type="file" name="file[]" multiple /><br />
</div><!-- ./col -->
<input type="submit" class="form-control"name="submit" value="Submit" />
</form>
<?php
include ("connection.php");
if(isset($_POST["submit"])) {
//prepare the insert before you start looping
$ins_stmt = $link->prepare('INSERT INTO salesreceiptlinedetail
(ItemRef_FullName) VALUES(?)';
// check the prepare worked and the the query is correctly coded
if (FALSE === $ins_stmt) {
echo 'Error: '.$link->error;
exit;
}
foreach ( $_FILES['file']['tmp_name'] as $file ) {
$handle = fopen($file, "r");
$c = 0;
// read and ignore headers
fgetcsv($handle);
while(($filesop = fgetcsv($handle, 10000, ",")) !== false) {
$ins_stmt->bind_param('s', $filesop[1]);
$ins_stmt->execute();
$c++;
}
}
}
?>