Upload file and access $_FILES - php

Question

I'm trying to upload a file on some directory. The directory is recorded in the database. However, the code cannot read $_FILES i get null value everytime i try to upload files,. but the other input data are recorded to the database,. what happen is I cannot record the name of the file in the database its just blank.
if(isset($_POST['btn-upload'])){
$record_title = $_POST['record_title'];
$record_recieved_date_time = $_POST['record_recieved_date_time'];
$record_checked_date_time = $_POST['record_checked_date_time'];
$record_approved_date_time = $_POST['record_approved_date_time'];
$record_status = $_POST['record_status'];
$record_remarks = $_POST['record_remarks'];
$record_type = $_POST['record_type'];
$file = $_FILES['file']['name'];
$sql = "INSERT INTO records (record_id , record_title , record_recieved_date_time , record_checked_date_time , record_approved_date_time , record_status ,record_remarks , file , record_type)
VALUES (NULL, '$record_title' , '$record_recieved_date_time','$record_checked_date_time','$record_approved_date_time' , '$record_status ' , '$record_remarks' , '$file' , '1')";
if (mysqli_query($dbconfig, $sql)) {
header('Location:memberAWP.php');
} else {
echo "Error: " . $sql . "<br>" . mysqli_error($dbconfig);
}
}
here is the Form, im using modal with the help of bootstrap
<form method="post" action="" enctype="multipart/form-data name="loginform" class="form-horizontal">
<div class="form-group">
<label class="control-label col-sm-2" for="record_title"> TITLE </label>
<div class="col-sm-10">
<input type="text" class="form-control" id="record_title" name = "record_title" placeholder="Enter Title">
</div>
</div>
<div class="form-group">
<label class="control-label col-sm-2" for="record_recieved_date_time"> RECIEVED DATE / TIME </label>
<div class="col-sm-10">
<input type="datetime-local" class="form-control" id="record_recieved_date_time" name = "record_recieved_date_time" placeholder="Enter RECIEVED DATE / TIME">
</div>
</div>
<div class="form-group">
<label class="control-label col-sm-2" for="record_checked_date_time"> CHECKED DATE / TIME </label>
<div class="col-sm-10">
<input type="datetime-local" class="form-control" id="record_checked_date_time" name = "record_checked_date_time" placeholder="Enter CHECKED DATE / TIME">
</div>
</div>
<div class="form-group">
<label class="control-label col-sm-2" for="record_approved_date_time"> APPROVED DATE / TIME</label>
<div class="col-sm-10">
<input type="datetime-local" class="form-control" id="record_approved_date_time" name = "record_approved_date_time" placeholder="Enter APPROVED DATE / TIME">
</div>
</div>
<div class="form-group">
<label class="control-label col-sm-2" for="record_status"> STATUS </label>
<div class="col-sm-10">
<input type="text" class="form-control" id="record_status" name = "record_status" placeholder="Enter STATUS">
</div>
</div>
<div class="form-group">
<label class="control-label col-sm-2" for="record_remarks"> REMARKS </label>
<div class="col-sm-10">
<input type="text" class="form-control" id="record_remarks" name = "record_remarks" placeholder="Enter REMARKS">
</div>
</div>
<div class="form-group">
<label class="control-label col-sm-2" for="file"> ATTACHMENTS </label>
<div class="col-sm-10">
<input type="file" class="form-control" id="file" name="file" placeholder="Enter ATTACHMENTS">
</div>
</div>
<div class="form-group">
<div class="col-sm-offset-2 col-sm-10">
<button type="submit" name="submit" value="submit" class="btn btn-default">Submit</button>
</div>
</div>
</form>

Answer 1

if( isset( $_POST['btn-upload'], $_FILES['file'] ) ){
/*
The sql is vulnerable to sql injection as you directly embed variables within the sql
rather than using `prepared statements` so some extra care ought to be taken with the supplied
data, perhaps use:
filter_input( INPUT_POST, 'record_title', FILTER_SANITIZE_STRING );
*/
$record_title = $_POST['record_title'];
$record_recieved_date_time = $_POST['record_recieved_date_time'];
$record_checked_date_time = $_POST['record_checked_date_time'];
$record_approved_date_time = $_POST['record_approved_date_time'];
$record_status = $_POST['record_status'];
$record_remarks = $_POST['record_remarks'];
$record_type = $_POST['record_type'];
/*
Access the uploaded file as an object for simplicity
and use the values for saving the file etc
*/
$obj=(object)$_FILES['file'];
$file = $obj->name;
$size = $obj->size;
$tmp = $obj->tmp_name;
$type = $obj->type;
$error= $obj->error;
if( is_uploaded_file( $tmp ) && $error == UPLOAD_ERR_OK ){
/* determine the location the file should be saved to */
$destination = '/path/to/folder/' . $file;
/* Save the file */
$result = move_uploaded_file( $tmp, $destination );
/* Proceed with the sql command if the file was saved OK */
if( $result ){
$sql = "INSERT INTO records ( `record_title`, `record_recieved_date_time`, `record_checked_date_time`, `record_approved_date_time`, `record_status`, `record_remarks`, `file`, `record_type`)
VALUES ( '$record_title', '$record_recieved_date_time', '$record_checked_date_time', '$record_approved_date_time', '$record_status', '$record_remarks', '$file', '1' )";
$result = mysqli_query( $dbconfig, $sql );
if( $result )header('Location:memberAWP.php');
else echo "Error: " . $sql . "<br>" . mysqli_error($dbconfig);
}
}
}
As was pointed out in a comment, ensure that the form has the correct enctype attribute set - for file uploads it should be enctype='multipart/form-data'
Unless you use the move_uploaded_file() function the file will remain in the tmp directory for a limited time before garbage collection removes it and the reference to the file ( in the db ) will no longer be valid.

Answer 2

There are some basics thing you should know when working on file uploading.
1) You should define encryption type in your form for example
<form action="demo_post_enctype.asp" method="post" enctype="multipart/form-data">
2) Next you must use move_uploaded_file(source,destination) function in order to upload your file.

Answer 3

<form method="post" enctype="multipart/form-data" name="loginform" class="form-horizontal">
<div class="form-group">
<label class="control-label col-sm-2" for="record_title"> TITLE </label>
<div class="col-sm-10">
<input type="text" class="form-control" id="record_title" name = "record_title" placeholder="Enter Title">
</div>
</div>
<div class="form-group">
<label class="control-label col-sm-2" for="record_recieved_date_time"> RECIEVED DATE / TIME </label>
<div class="col-sm-10">
<input type="datetime-local" class="form-control" id="record_recieved_date_time" name = "record_recieved_date_time" placeholder="Enter RECIEVED DATE / TIME">
</div>
</div>
<div class="form-group">
<label class="control-label col-sm-2" for="record_checked_date_time"> CHECKED DATE / TIME </label>
<div class="col-sm-10">
<input type="datetime-local" class="form-control" id="record_checked_date_time" name = "record_checked_date_time" placeholder="Enter CHECKED DATE / TIME">
</div>
</div>
<div class="form-group">
<label class="control-label col-sm-2" for="record_approved_date_time"> APPROVED DATE / TIME</label>
<div class="col-sm-10">
<input type="datetime-local" class="form-control" id="record_approved_date_time" name = "record_approved_date_time" placeholder="Enter APPROVED DATE / TIME">
</div>
</div>
<div class="form-group">
<label class="control-label col-sm-2" for="record_status"> STATUS </label>
<div class="col-sm-10">
<input type="text" class="form-control" id="record_status" name = "record_status" placeholder="Enter STATUS">
</div>
</div>
<div class="form-group">
<label class="control-label col-sm-2" for="record_remarks"> REMARKS </label>
<div class="col-sm-10">
<input type="text" class="form-control" id="record_remarks" name = "record_remarks" placeholder="Enter REMARKS">
</div>
</div>
<div class="form-group">
<label class="control-label col-sm-2" for="file"> ATTACHMENTS </label>
<div class="col-sm-10">
<input type="file" class="form-control" id="file" name="file" placeholder="Enter ATTACHMENTS">
</div>
</div>
<div class="form-group">
<div class="col-sm-offset-2 col-sm-10">
<button type="submit" name="btn-upload" value="submit" class="btn btn-default">Submit</button>
</div>
</div>
</form>
change html code after try this code
if(isset($_POST['btn-upload']))
{
$record_title = $_POST['record_title'];
$record_recieved_date_time = $_POST['record_recieved_date_time'];
$record_checked_date_time = $_POST['record_checked_date_time'];
$record_approved_date_time = $_POST['record_approved_date_time'];
$record_status = $_POST['record_status'];
$record_remarks = $_POST['record_remarks'];
// $record_type = $_POST['record_type'];
$file = $_FILES['file']['name'];
//echo $fileName= $_FILES["file"]["name"];
echo $sql = "INSERT INTO records (record_id , record_title , record_recieved_date_time , record_checked_date_time , record_approved_date_time , record_status ,record_remarks , file , record_type)
VALUES (NULL, '$record_title' , '$record_recieved_date_time','$record_checked_date_time','$record_approved_date_time' , '$record_status ' , '$record_remarks' , '$file' , '1')";
if (mysqli_query($dbconfig, $sql)) {
header('Location:memberAWP.php');
} else {
echo "Error: " . $sql . "<br>" . mysqli_error($dbconfig);
}
}
try this code

Answer 4

First of go to your project folder and create a new folder with the name of "uploads". the try the following code. if file upload get successfully done you can write your query in the IF block where we used echo for success. but first try this. i hope it works for you.
<?php
if(isset($_POST['submit'])){
$record_title = $_POST['record_title'];
$record_recieved_date_time = $_POST['record_recieved_date_time'];
$record_checked_date_time = $_POST['record_checked_date_time'];
$record_approved_date_time = $_POST['record_approved_date_time'];
$record_status = $_POST['record_status'];
$record_remarks = $_POST['record_remarks'];
$record_type = $_POST['record_type'];
$file = $_FILES['file']['name'];
$target_dir = "uploads/";
$path = $target_dir.$file;
$tmp = $_FILES['file']['tmp_name'];
if(move_uploaded_file($tmp,$path))
{
echo "File successfully uploaded";
}
else
echo "file did not upload";
}
?>
<!DOCTYPE html>
<html>
<head>
<title></title>
</head>
<body>
<form method="post" action="" enctype="multipart/form-data" name="loginform" class="form-horizontal">
<div class="form-group">
<label class="control-label col-sm-2" for="record_title"> TITLE </label>
<div class="col-sm-10">
<input type="text" class="form-control" id="record_title" name = "record_title" placeholder="Enter Title">
</div>
</div>
<div class="form-group">
<label class="control-label col-sm-2" for="record_recieved_date_time"> RECIEVED DATE / TIME </label>
<div class="col-sm-10">
<input type="datetime-local" class="form-control" id="record_recieved_date_time" name = "record_recieved_date_time" placeholder="Enter RECIEVED DATE / TIME">
</div>
</div>
<div class="form-group">
<label class="control-label col-sm-2" for="record_checked_date_time"> CHECKED DATE / TIME </label>
<div class="col-sm-10">
<input type="datetime-local" class="form-control" id="record_checked_date_time" name = "record_checked_date_time" placeholder="Enter CHECKED DATE / TIME">
</div>
</div>
<div class="form-group">
<label class="control-label col-sm-2" for="record_approved_date_time"> APPROVED DATE / TIME</label>
<div class="col-sm-10">
<input type="datetime-local" class="form-control" id="record_approved_date_time" name = "record_approved_date_time" placeholder="Enter APPROVED DATE / TIME">
</div>
</div>
<div class="form-group">
<label class="control-label col-sm-2" for="record_status"> STATUS </label>
<div class="col-sm-10">
<input type="text" class="form-control" id="record_status" name = "record_status" placeholder="Enter STATUS">
</div>
</div>
<div class="form-group">
<label class="control-label col-sm-2" for="record_remarks"> REMARKS </label>
<div class="col-sm-10">
<input type="text" class="form-control" id="record_remarks" name = "record_remarks" placeholder="Enter REMARKS">
</div>
</div>
<div class="form-group">
<label class="control-label col-sm-2" for="file"> ATTACHMENTS </label>
<div class="col-sm-10">
<input type="file" class="form-control" id="file" name="file" placeholder="Enter ATTACHMENTS">
</div>
</div>
<div class="form-group">
<div class="col-sm-offset-2 col-sm-10">
<button type="submit" name="submit" value="submit" class="btn btn-default">Submit</button>
</div>
</div>
</form>
</body>
</html>