How to retrieve uploaded files using php

Ok. I have searching on this site Since August 24 2011.(not that it matters) for a way to display files that have been uploaded by a user. I have my form on the admin side and everything is working fine. I also have a table displaying whatever the user has filled in the form which also works. But I can not view the file or its name on the table.

My database table has a primary id auto_increment int(11) unsigned.

Here is the code I wrote:

//This gets all the other information from the form 
$company=$_POST['company']; 
$location=$_POST['location'];
$pic=($_FILES['userfile']['name']);

$query = "INSERT INTO user_DB VALUES ('','$company', '$location', '$userfile' )";

//target to the path of my files
$target_path = "uploads/post_id/";
if(!is_dir($target_path)) mkdir($target_path);
$uploadfile = $target_path . basename($_FILES['userfile']['name']);

//Move the uploaded file to $taget_path
(move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile));

On the form which you fill in the details I have the following:

<tr>
<td><label for="company_name">Company Name</label></td>
<td><input type="text" name="company" id="company" value="" size="38" /></td>
</tr>
<tr>
<td><label for="location">Location</label></td>
<td><input type="text" name="location" id="location" value="" /></td>
</tr>
<tr>
<td>Upload a File:</td>
<td><input name="userfile" id="userfile" type="file" /></td>
</tr>

The table which is on the front end that displays the query results looks like this, just the file feil开发者_如何学编程d.

echo "<td>";
echo "<a href=../admin/uploads/post_id/> $row'userfile'</a>";
echo "</td>";

So as you can see I am trying to get the file name as well as the file itself. If its a pdf/ jpg/doc I should be able to view/download it when I click the link.

Ant ideas ...

---

Some suggestions for what you could change to get this working.

1. Upload form

What does your form tag look like? Don't forget to include the enctype parameter as per below:

<form type="post" action="" enctype="multipart/form-data">
    ...
</form>

2. Sanitisation

$company  = mysql_real_escape_string($_POST['company']); 
$location = mysql_real_escape_string($_POST['location']);
$pic      = mysql_real_escape_string($_FILES['userfile']['name']);

The above lines are the first step in helping to prevent your queries from suffering SQL injection attacks.

3. SQL Query

$userfile does not exist as you have actually assigned the file name to $pic instead so your query should look like this:

$query = "INSERT INTO user_DB 
          VALUES ('','$company', '$location', '$pic')";

4. HTML Output

Now to link to the file in your output table:

echo "<td>";
echo "<a href=" . $target_path . basename($row['userfile']) . ">
         {$row['userfile']}</a>";
echo "</td>";

---

i think sould replace this

$query = "INSERT INTO user_DB VALUES ('','$company', '$location', '$userfile' )";

with

$query = "INSERT INTO user_DB VALUES ('','$company', '$location', '$pic' )";

---

Something very basic that you might have missed is the form enctype. Many begginers does this. So just check if you have the enctype attribute in the form.

<form enctype="multipart/form-data">

Only if you have this you can upload files through your forms. Another place where you could possibly gone wrong is

$query = "INSERT INTO user_DB VALUES ('','$company', '$location', '$userfile' )";

You store the file name in a variable called $pic but here you have given $userfile so just try changing that into $pic.

---

you can use one column as auto_increament

when you are inserting a new user than you can get sum of already registered users using this query

$qry = mysql_qyery("select * from users"); and you can get user count by using

$count = mysql_num_rows($qry); so after this you insert a new user and his ID will be

$count1 = $count+1; $id = 'F'.$count1;