Member Avatar for CarterLangley

Hi guys,

Got a problem uploading an image to a directory and then including that directory location into the database so that I can display the image.

Here is the code I have so far.

<div id="main_right">
<?php
if ($picture)
{
?>
<img src="<?php echo "../images/teacher_photo/" . $picture ?>" alt="<?php $picture ?>" height="200" width="200">
<?php
}
else
{
?>
<form action="addimages.php" method="post" enctype="multipart/form-data">
<table border=0>
<tr><td>Select Image: </td><td><input type="file" name="image"></td></tr>
<tr> <td><input type="submit" name="Submit" value="Upload" ></td></tr>
</table>
</form>
</div>

and the addimages.php page looks like this

<?php
include("db_connect.php");
if (!isset($_FILES['image']['tmp_name'])) {
echo "";
}else{
$file=$_FILES['image']['tmp_name'];
$image= addslashes(file_get_contents($_FILES['image']['tmp_name']));
$image_name= addslashes($_FILES['image']['name']);
move_uploaded_file($_FILES["image"]["tmp_name"],"../images/teacher_photo/" . $_FILES["image"]["name"]);
$location="../images/teacher_photo" . $_FILES["image"]["name"];
$sql_photo = "INSERT INTO `person` (photo) VALUES ('&location') WHERE person_id = " .$person_id;
$save = mysql_query($sql_photo,$conn);
echo "<script type=\"text/javascript\">window.location=\"admin.php\"</script>";
}
?>

So, any idea where I am going wrong?

  • 2 Contributors
  • 3 Replies
  • 251 Views
  • 2 Hours Discussion Span
  • Latest Post Latest Post by pritaeas

Dani AI

Generated

— two separate problems are visible in the thread. was right about the ampersand/dollar bug, but the bigger cause of the SQL error is that MySQL does not accept INSERT ... WHERE. If updating an existing person row, use UPDATE ... WHERE; if inserting a new row, use INSERT without WHERE and include all required columns. The error text also matches an empty $person_id (Post #4). Finally, the $location string in the posted code is missing a slash and the <img> alt output is not being echoed or escaped.

A concise, safer workflow (sanitize filename, move file, store a web path, use prepared statement):

$person_id = intval($_POST['person_id'] ?? 0);
if ($person_id <= 0) { die('Missing person_id'); }

$orig = $_FILES['image']['name'];
$clean = preg_replace('/[^A-Za-z0-9._-]/', '_', basename($orig));
$targetDir = __DIR__ . '/../images/teacher_photo/';
$targetPath = $targetDir . $clean;

if (is_uploaded_file($_FILES['image']['tmp_name']) && move_uploaded_file($_FILES['image']['tmp_name'], $targetPath)) {
    $dbPath = 'images/teacher_photo/' . $clean;
    $stmt = $mysqli->prepare('UPDATE person SET photo = ? WHERE person_id = ?');
    $stmt->bind_param('si', $dbPath, $person_id);
    $stmt->execute();
    if ($stmt->error) { error_log('DB error: ' . $stmt->error); }
}

Quick troubleshooting checklist:

  • Confirm $person_id is set and integer (avoid the trailing empty WHERE).
  • Verify move_uploaded_file() returns true and the target directory exists and is writable.
  • Ensure the stored path uses the correct slash (filesystem path for move, web-relative path for HTML).
  • Sanitize filenames, avoid overwrites (add a timestamp/hash if needed).
  • Use prepared statements (mysqli or PDO) instead of mysql_*.
  • Escape output in HTML (htmlspecialchars) for src/alt.

Applying the above will fix the SQL syntax error and make the upload flow more secure and reliable.

Recommended Answers

All 3 Replies

Member Avatar for pritaeas

$sql_photo = "INSERT INTO person (photo) VALUES ('&location') WHERE person_id = " .$person_id;

Do not use an ampersand, but a dollar sign:

$sql_photo = "INSERT INTO `person` (photo) VALUES ('$location') WHERE person_id = " . $person_id;
Member Avatar for CarterLangley

OK, need to hit myself over the head for that mistake!

Fixed that, but now getting this error.

Could not get data: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1

Probably a silly mistake I am making, but can't seem to find it....

Member Avatar for pritaeas

Show the query that is being executed. My guess is an empty $person_id

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.