can't copy uploaded file (php) - php

Question

I'm creating a site that displays news uploaded on it's admin panel.
Each post has an image and a title (and description, but i haven't implemented it yet).
My problem is, that when i try to post (and upload image with it) the post is created, but the image doesn't exist.
uploader (php):
if (isset($_FILES['image'])) {
//this script
//connects to mysql database
//declares an array that contains table names (array name is db)
require_once("db.php");
//move file to the img folder
move_uploaded_file($_FILES['image']['tmp_name'], "img/" . $_FILES['image']['tmp_name']);
//upload the post to the database
$sql = "INSERT INTO `{$db["posts"]}` (`img`, `text`) VALUES ('img/{$_FILES['image']['tmp_name']}', '{$_POST["text"]}')";
if (!mysql_query($sql)) {
//display error message
}
}
form (html):
<form action="post.php" method="POST" enctype="multipart/form-data">
<label>Image: </label><input type="file" name="image" />
<br />
<label>Text: </label><input type="text" name="text" />
<input type="submit" />
</form>
I check the files via ftp after posting, the image doesn't exist.

Answer 1

$_FILES['image']['tmp_name'] is an absolute pathname like /var/tmp/something. When you concatenate it to img/, you get a pathname that points into a subdirectory, img//var/tmp/something. Since the subdirectory doesn't exist, move_uploaded_file() fails.
You should use basename() to get just the filename portion.
$filename = 'img/' . basename($_FILES['image']['tmp_name']);
move_uploaded_file($_FILES['image']['tmp_name'], $filename);
$text = mysql_real_escape_string($_POST['text']);
$sql = "INSERT INTO `{$db["posts"]}` (`img`, `text`) VALUES ('$filename', '$text')";
I'm not really sure how safe using the name of the temp file this way is, though. I don't think there's any guarantee that it will never repeat the same name for different uploads.