i can't move an uploaded image to a spesific directory - php

Question

This is my code :
<?php
session_start();
include "connect.php";
$username=$_SESSION['username'];
if(isset($_SESSION['username'])){
$teks= mysql_real_escape_string($_POST['teks']);
$photo= $_POST['photo'];
$path_file = pathinfo($_FILES['photo']['name']);
$type_file = $_FILES['photo']['type'];
$name_file = $_FILES['photo']['name'];
$directory = "image/$nama_file";
if (!empty($lokasi_file)) {
move_uploaded_file($lokasi_file,$direktori); }
$sql=mysql_query("SELECT username from member where username='$username'");
$result=mysql_fetch_array($sql);
mysql_query("Insert into posting (username, pic_post, text_post, location, datetime) values('$username','$photo','$teks', '$photo', NOW())");
header("Location: member.php");
}
?>
I've got an issue with this code, and can't move the uploaded image into the /image folder.

Answer 1

The code you have written is full of bugs
$photo= $_POST['photo']; This is wrong... $photo= $_FILES['photo'];
Please go through the bellow Link, you will find a good tutorial here.
http://www.w3schools.com/php/php_file_upload.asp
New Edit : ( I have Just edited the your code)
<?php
session_start();
include "connect.php";
$username=$_SESSION['username'];
if(isset($_SESSION['username'])){
$teks= mysql_real_escape_string($_POST['teks']);
$photo= $_FILES['photo']['name'];
$path_file = pathinfo($_FILES['photo']['name']);
$type_file = $_FILES['photo']['type'];
$name_file = $_FILES['photo']['name'];
$directory = "image/$nama_file";
$target_file = $directory . basename($_FILES["photo"]["name"]);
if (!empty($lokasi_file)) {
move_uploaded_file($_FILES["photo"]["tmp_name"], $target_file);
}
$sql=mysql_query("SELECT username from member where username='$username'");
$result=mysql_fetch_array($sql);
mysql_query("Insert into posting (username, pic_post, text_post, location, datetime) values('$username','$photo','$teks', '$photo', NOW())");
header("Location: member.php");
}
?>

Answer 2

You have several erros in your code.
Check this block
$photo= $_POST['photo'];
$path_file = pathinfo($_FILES['photo']['name']);
$type_file = $_FILES['photo']['type'];
$name_file = $_FILES['photo']['name'];
$directory = "image/$nama_file";
Files are in $_FILES array, not in $_POST, so your photo will be $photo= $_FILES['photo'];
You never use $path_file, so why is it?
You have a type, with $nama_file, that is $name_file
Where is $lokasi_file and $direktori come from? That should be $_FILES['photo']['tmp_name'] in move upload.
Do not use mysql functions, they are deprecated. Use mysqli or PDO instead.
Escape your variables comes from outside, because of sql injection, or use prepared statements.
You do not use the result of your first $sql.
You can not store $photo in your database, because that is an array
Add exit; or die; after redirection.
Sidenote: Why are you store the location of the file twice?
So your final code will be something like this, but again, change the mysql_ functions!
session_start();
include "connect.php";
$username = $_SESSION['username'];
if (isset($_SESSION['username'])) {
$teks = mysql_real_escape_string($_POST['teks']);
$type_file = $_FILES['photo']['type'];
$name_file = "image/" . basename($_FILES['photo']['name']);
if (move_uploaded_file($_FILES["photo"]['tmp_name'], $name_file)) {
//Why is it here, for what? Never used the $res (what is acually $row)
//$sql = mysql_query("SELECT username from member where username='" . mysql_real_escape_string($username) . "'");
//$res = mysql_query($sql);
mysql_query("Insert into posting (username, pic_post, text_post, location, datetime) "
. "values('" . mysql_real_escape_string($username) . "',"
. " '" . mysql_real_escape_string($name_file) . "',"
. " '" . $teks . "',"
. " '" . mysql_real_escape_string($name_file) . "', NOW())");
header("Location: member.php");
die();
}
}

Answer 3

thanks so much for answer..
and here is my successfully code :
<?php
session_start();
include "connect.php";
$username=$_SESSION['username'];
if(isset($_SESSION['username'])){
$koneksi = mysqli_connect("localhost","root","");
mysqli_select_db($koneksi, "dbjashik");
$teks = $_POST['teks'];
$folder = "image";
$tmp_name = $_FILES["photo"]["tmp_name"];
$name = $folder."/".$_FILES["photo"]["name"];
//to moving the file into /image directory
move_uploaded_file($tmp_name, $name);
//inserting query
$input = mysqli_query($koneksi, "INSERT INTO posting VALUES(null, '$username', '$name' ,'$teks', '$name', NOW() )");
header("Location: member.php");
}
?>