cannot upload file using uploadify - php

Question

i have problem with uploadify.
on client it's working very nice
(all features like button,progress,etc. and file can be uploaded on client)
but on the hosting (server), the file cannot be uploaded.
on server, the another (button,progress,script for upload) is working,
only file that i want to upload cannot be uploaded.
otherwise i have some process to insert to database (the path of file), i put the insert sql query on script for uploading process, the query is working but file cannot be uploaded
my script (upload_file.php):
<?php
$file_id = $_POST['file_id'];
if (!empty($_FILES))
{
$tempFile = $_FILES['Filedata']['tmp_name'];
$targetPath = $_SERVER['DOCUMENT_ROOT'] . $_REQUEST['folder'] . '/';
$targetFile = str_replace('//','/',$targetPath) . $_FILES['Filedata']['name'];
$destinationFile = "files/". $_FILES['Filedata']['name'];
move_uploaded_file($tempFile,$targetFile);
//additional - query to insert the path
include("database_connection.php");
$query = "insert into file (file_id,path) values ('$file_id','$destinationFile')";
$result = mysql_query($query);
mysql_close();
} ?>
and the javascript:
$('#file').uploadify
({
'uploader' : '/myweb/shockwaves/uploadify.swf',
'script' : '/myweb/process/upload_file.php',
'cancelImg' : '/myweb/images/uploadify/cancel.png',
'folder' : '/myweb/files',
'auto' : true,
'buttonText' : 'Upload',
'scriptData' : {'file_id':'001'}
});
thanks :)

Answer 1

We need more information, but the possibilities that come to mind:
Your form HTML is incorrect.
The file is too large.
The filename is too long.
File write permissions issue on server.
Ensure your HTML form has "enctype"
Ensure your HTML form on the page has enctype="multipart/form-data" e.g.
<form action="" method="POST" enctype="multipart/form-data">
Diagnosing PHP error / file write error
If it's a file / permissions issue, you might be able to spot a PHP error, so try enabling error reporting on the page as below:
<?php
error_reporting(E_ALL);
ini_set("display_errors", 1);
?>
Change file_id to be automatically generated
You should also change your database so that it is generating your file_id (i.e. auto-incrementing primary key / identity), rather than passing one in. If you don't have it auto-generate, you run the risk of duplicate file_id entries (or a failed query if the file_id column is a Primary Key as it should be).
Presumably you are also not actually using 'scriptData' : {'file_id':'001'} as this would mean you are inserting the file_id of 001 for every record. However, even client-size generation of this runs the risk of a) people picking their own file_id and corrupting your data, b) errors when JS is disabled (uploadify won't work, but file will probably still work) and c) duplicate file_id generation.
Your sample is vulnerable to SQL Injection
Your current sample is particularly vulnerable to SQL Injection, as you are not escaping your parameters. You might dismiss this as "oh it's okay it's an internal app so there's no security risk" but even accidental SQL Injection can cause issues. If this is a public facing website you've just exposed your database. I'm going to assume this is a reduced sample, but even then it's ill-advised to post unescaped SQL (at least without a comment), as it just leads to other less experienced developers copy/pasting it into an app somewhere.