Save in DB 3 images at the same time - php

Question

I have a basic image upload which is working nice but now I need to save it in my MySql DB 3 images not only one, How can I save 3 images in the same form with my upload script?
I need to save 3 images because is an article blog in my page and I want to show the 3 images in a slider in the preview, so because that, I need to save 3 images in the same id.
Another think is, How can just save one or two without the upload script show me error because one or two or even the three files upload are empty?
Here I show you my upload script:
<?php
require_once("connection.php");
require_once("settings.php");
$alert = "";
if(isset($_FILES['foto_ser1'])) {
$extension = pathinfo($_FILES['foto_ser1']['name']);
$extension = $extension["extension"];
$allowed_paths = explode(", ", $allowed_ext);
$valid = 0;
for($i = 0; $i < count($allowed_paths); $i++) {
if ($allowed_paths[$i] == "$extension") {
$valid = 1;
}
}
if ($valid == 1 && $_FILES["foto_ser1"]["size"] <= $max_weight) {
if (file_exists("../assets/img/servicios/" . $_FILES["foto_ser1"]["name"])) {
$alert = '<p class="error">' . $_FILES["foto_ser1"]["name"] . ' El nombre del archivo ya existe!' . '</p>';
} else {
move_uploaded_file($_FILES["foto_ser1"]["tmp_name"], "../assets/img/servicios/" . $_FILES["foto_ser1"]["name"]);
$save1 = $_FILES["foto_ser1"]["name"];
$statement = $conn->prepare("INSERT INTO SERVICIOS (titulo, descripcion, categoria, foto_ser1, foto_ser2, foto_ser3) VALUES (?, ?, ?, ?, ?, ?)");
if ($statement->execute(array($_POST['titulo'],$_POST['descripcion'],$_POST['categoria'],$save1,$save2,$save3)));
$dbSuccess = true;
$alert = '<p class="ok">' . ' Servicio agregado satisfactoriamente!' . '</p>';
$dbh = null;
}
} else {
$alert = '<p class="error">' . ' Tipo de archivo inválido!' . '</p>';
}
}
?>
form page.php:
<form class="form-horizontal" id="servicios" name="data" method="post" enctype="multipart/form-data">
<fieldset>
<?php echo $alert1; ?>
<div class="control-group">
<label class="control-label col-md-4"><?php echo $translate->__('Title'); ?> :</label>
<div class="col-md-5">
<input type="text" class="form-control" name="titulo" />
</div>
</div>
<div class="control-group">
<label class="control-label col-md-4"><?php echo $translate->__('Article info'); ?> :</label>
<div class="col-md-5">
<textarea id="maxlength_textarea" class="form-control" maxlength="225" name="descripcion" /></textarea>
</div>
</div>
<div class="control-group">
<label class="control-label col-md-4"><?php echo $translate->__('Article category'); ?> :</label>
<div class="col-md-5">
<input type="text" class="form-control" name="categoria" />
</div>
</div>
<div class="control-group">
<label class="control-label col-md-4"><?php echo $translate->__('File to upload 1'); ?> :</label>
<div class="col-md-3">
<input name="foto_ser1" type="file" />
</div>
</div>
<div class="control-group">
<label class="control-label col-md-4"><?php echo $translate->__('File to upload 2'); ?> :</label>
<div class="col-md-3">
<input name="foto_ser2" type="file" />
</div>
</div>
<div class="control-group">
<label class="control-label col-md-4"><?php echo $translate->__('File to upload 3'); ?> :</label>
<div class="col-md-3">
<input name="foto_ser3" type="file" />
</div>
</div>
<div class="control-group">
<div class="row">
<div class="col-md-12">
<div class="col-sd-offset-9 col-md-12"><br />
<button class="btn btn-info" name="enviar"><i class="fa fa-check"></i> <?php echo $translate->__('Save'); ?></button>
</div>
</div>
</div>
</div>
</fieldset>
</form>
<div id="loading" style="display:none;"><img src="assets/img/ajax_loader.gif" /></div>
EDIT
The new code:
<?php
require_once("includes/connection.php");
require_once("includes/settings.php");
$alert = "";
if(isset($_FILES['foto_ser{$i}'])) {
for($i = 1; $i <= 3; $i++) {
if ($_FILES["foto_ser{$i}"]['error'] === UPLOAD_ERR_OK) {
if ($valid == 1 && $_FILES["foto_ser{$i}"]["size"] <= $max_weight) {
if (file_exists("assets/img/servicios/" . $_FILES["foto_ser{$i}"]["name"])) {
$alert = '<div class="alert alert-block alert-danger fade in">
<button type="button" class="close" data-dismiss="alert"></button>
<h4 class="alert-heading">Error!</h4>
<p>' . $_FILES["foto_ser{$i}"]["name"] . ' El nombre de la foto ya existe!' . '</p></div>';
} else {
move_uploaded_file($_FILES["foto_ser{$i}"]["tmp_name"], "assets/img/servicios/" . $_FILES["foto_ser{$i}"]["name"]);
$save1 = $_FILES["foto_ser{$i}"]["name"];
$save2 = $_FILES["foto_ser{$i}"]["name"];
$save3 = $_FILES["foto_ser{$i}"]["name"];
$activo = is_array($_POST['activo'])
? implode(', ', $_POST['activo'])
: $_POST['activo'];
$statement = $conn->prepare("INSERT INTO SERVICIOS (titulo_ser, stitulo_ser, servicios, precio, foto_ser1, foto_ser2, foto_ser3, categoria, subcategoria, visto, activo) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
if ($statement->execute(array($_POST['titulo_ser'],$_POST['stitulo_ser'],$_POST['servicios'],$_POST['precio'],$save1,$save2,$save3,$_POST['categoria'],$_POST['subcategoria'],$_POST['visto'],$activo)));
$dbSuccess = true;
$alert = '<div class="alert alert-block alert-success fade in">
<button type="button" class="close" data-dismiss="alert"></button>
<h4 class="alert-heading">Success!</h4>' . ' Nuevo servicio agregado satisfactoriamente!' . '</p></div>';
$dbh = null;
}
} else {
$alert = '<div class="alert alert-block alert-danger fade in">
<button type="button" class="close" data-dismiss="alert"></button>
<h4 class="alert-heading">Error!</h4>
<p>' . ' Tipo de imagen inválida!' . '</p></div>';
}
}
}
}
?>

Answer 1

You need to have upload handling. Right now your code is simply ASSUMING that all uploads will always succeed. Indeed, it assumes there will NEVER not be an upload.
In short, you need something like this:
for ($i = 1; $i <= 3; $i++) {
if ($_FILES["foto_ser{$i}"]['error'] === UPLOAD_ERR_OK) {
...file #$i has succeeded...
}
}
Your code is also quite dangerous - you're directly using the user-provided ['name']parameter in your move_uploaded_files call, which allows a malicious user to scribble a file of their choosing ANYWHERE on your server.