Member Avatar for Warl30ck

I was working on this script which let's you upload and everything is logged in the database. I got this error, any help?

Error :You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '/home/a6771073/public_html/upload/img.png)' at line 1

Code:

<html> 
<body>
  <form enctype="multipart/form-data"  method="post">
    <input type="hidden" name="MAX_FILE_SIZE" value="1000000" />
    Choose a file to upload: <input name="uploaded_file" type="file" />
    <input type="submit" value="Upload" />
  </form> 
</body> 
</html>

<?php
include 'global.php';
//Check that we have a file
if((!empty($_FILES["uploaded_file"])) && ($_FILES['uploaded_file']['error'] == 0)) 
{

  //Check if the file is size is less than 350Kb
  $filename = basename($_FILES['uploaded_file']['name']);

  $ext = substr($filename, strrpos($filename, '.') + 1);

  if (($_FILES["uploaded_file"]["size"] < 350000)) 
  {
    //Determine the path to which we want to save this file
      $newname = dirname(__FILE__).'/upload/'.$filename;

      //Check if the file with the same name is already exists on the server
      if (!file_exists($newname)) 
      {
        //Attempt to move the uploaded file to it's new place
        if ((move_uploaded_file($_FILES['uploaded_file']['tmp_name'],$newname))) 
        {
           $rand = rand(1, 1024) . "_" . rand(3, 2673) . "_" . rand(5, 7337);
           $name = $_FILES["uploaded_file"]["name"];
           mysql_query("INSERT INTO uploads(id, name, todownloadname, path) VALUES(" . $rand . ", " . $name . ", " . $name . ", " . $newname . ")")or die(mysql_error());
           echo "It's done! The file has been saved ";
        } 
        else 
        {
           echo "Error: A problem occurred during file upload!";
        }
      }  
      else 
      {
         echo "Error: File ".$_FILES["uploaded_file"]["name"]." already exists";
      }
  }  
  else  
  {
     echo "Error: Only files under 350Kb are accepted for upload";
  }
} 
else  
{
 echo "Error: No file uploaded";
}
?>
  • 2 Contributors
  • 1 Reply
  • 112 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by dos_killer
Member Avatar for dos_killer

for debugging in such situations, i always do

$sql = " whatever query ".$var;
echo $sql;
die();

now what you can do is see the query, copy it into the mysql console or wherever you wish...and run it from there...this will precisely tell you the error ...

i didnt want to read through the code much, being lazy... but one possible error could be the missing quotes around the variables in the query ... you know string parameters require quotes....

try something like this

$sql = " insert into abc ( a1) values ('".$var."')";
Edited by dos_killer because: n/a
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.