Inserting id into MYSQL table for multiple image upload(homestay) - php

Question

I currently have a form that creates an item in a database then in the next step it allows the user to upload multiple images for that listing both sections work on their own but i need to be able to insert the $id from the first page into the query for the image upload to identify which listing it corresponds to
Here is the page to allow the user to upload multiple images
<input name="name" type="text" id="name" size="40" placeholder="Homestay's Name"/>
<input name="type" type="text" id="type" size="40" placeholder="Homestay's Type"/>
<input name="category" type="text" id="category" size="40" placeholder="Homestay's Category"/>
<input class='file' multiple="multiple" type="file" class="form-control" name="userfile[]" placeholder="Please choose your image">
here is the function
$path = pathinfo($_SERVER['PHP_SELF']);
for ($i = 0; $i < count ($_FILES['userfile']['name']); $i++)
{
$tmp_file = $_FILES['userfile']['tmp_name'][$i];
$filetype = $_FILES['userfile']['type'][$i];
$filesize = $_FILES['userfile']['size'][$i];
$filename = $_FILES['userfile']['name'][$i];
$destination = $path['dirname'] . '../data/' . $filename;
if (move_uploaded_file($tmp_file, $_SERVER['DOCUMENT_ROOT'] . $destination))
{
$name = $_POST['name'];
$type = $_POST['type'];
$category = $_POST['category'];
$sql="INSERT INTO homestay (name, type,category,)
VALUES
('$name', '$type','$category')";
$result = mysql_query ("insert into img_homestay (id, location,filetype, filename, filesize)
values ('".$id."', '" . $destination . "','" . $filetype ."','" . $filename . "'," . $filesize . ") ");
}
}

Answer 1

If I understood your question:
In the previous page you have the id from the list.
At the second page, put it into a hidden field like:
<input type="hidde" name="theId" value="<?php echo $_POST["idFromPrevPage"]; ?>" />
And then you can access it from $_POST["theId"]
EDIT:
Based on your comment, I think, you want to do something like this:
$sql = "INSERT INTO homestay (name, type,category) VALUES ('".mysql_real_escape_string($name) ."', "
. "'".mysql_real_escape_string($type)."','".mysql_real_escape_string($category)."')";
$res = mysql_query($sql);
$id = mysql_insert_id(); //This where you can get the last insert id.
NOTES
Anyway, you have several problems in your original code:
In your first insert query have an unwanted , character at the field list.
Do not use mysql_* functions, they are deprecated. Use mysqli_* functions or PDO!
Escape your data to avoid sql vulnerables or use prepared statements.

Answer 2

I think your best bet would be :
create the form to insert the db item
get the ID of the inserted item, and add it as a hidden element on the second step
once the second form gets back, you can easily see the ID you need.
Do note that this approach will send DB id's client side, but is the simplest option.
A second approach is to utilize session variables - simply store the item ID to the user session, and retrieve it on the second step. This is safer, but not a good approach if multiple forms can be submitted at the same time by the same account/person.
$_SESSION['the_id'] = $result->id;
and then
$id = $_SESSION['the_id'];
The best approach (in my opinion always) is to use a non-sensical token to the client side, and map it to the proper ID using some logic. A simple example is to generate a complex hash for the ID, and send that as a hidden field to the user when sending the form for step 2. Store the ID and hash in a database table.
When the user POSTs that back, use the hash to map it back to a normal ID, and destroy the entry.