Update an image in php - php

Question

I have this form:
<form method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>" enctype="multipart/form-data">
<input type="file" name="file" />
<input type="submit" name="change" value="Update Image!" />
</form>
and this action here :
if(isset($_POST['change']))
{
$id = $_POST['id'];
$img = "photo_gallery/" .$_FILES["file"]["name"];
$query = "UPDATE gallery SET image =\"{$img}\" WHERE id = $id";
$up = mysql_query($query, $connection);
if(!$up){
echo die(mysql_error());
echo "error,not updated!";
}
}
The error is:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1
Any help for finding the error please!

Answer 1

You are not passing the id value in your form.
As a side note: you are exposed to a SQL injection attack both via the id parameter, as well as the file parameter... And if you pass the id in the form you may allow to maliciously alter images that were not intended to update.
=== Below: edited by someone else. As a note: htmlentites will not guard against SQL injection (use mysql_real_escape), and md5 will guard against injection but not against file overwriting (if someone uploads a file with the same name it will clash). Moreover, if you pass the ID in the form, one can change it and alter an unintended image. ===
Try to secure your code :
if(isset($_POST['change']))
{
$id = htmlentities($_POST['id']);
$img = "photo_gallery/" .md5($_FILES["file"]["name"]);
$query = "UPDATE gallery SET image =\"{$img}\" WHERE id = $id";
$up = mysql_query($query, $connection);
if(!$up)
{
echo die(mysql_error());
echo "error,not updated!";
}
}