Member Avatar for Sophia_1

Hi everyone, I have this issue, currently am able to save the attachment name in mysql database. However, after saving it doesn't display the attachment name in the form and so unable to open the attachment. Below is the coding. Please advise how to display the attachment name and open the attachment after clicking submit button. Really appreciate your help and thanks a lot.

<html> <body> <form name="progress" id="progress" method="post" action=""> <div id="tabs-1"> <?php
session_start();
$con = mysql_connect("localhost","user","");

if (!$con){

die("Can not connect: " . mysql_error());

}

mysql_select_db("pq",$con);

$Picid = $_GET['Picid'];
$nwQty = "SELECT * FROM progress WHERE Picid = '$Picid'";
// check if the progress is already
$solution = mysql_query($nwQty);

if(isset($_POST['submit'])){

if (mysql_num_rows($solution) == 0){

// put the progress in table
$sql = "INSERT INTO progress(Quanprogress1,Qualprogress1,Attachment1,Picid) VALUES ('" . $_POST["Quanprogress1"] . "','" . $_POST["Qualprogress1"] . "','" . $_POST["Attachment1"] . "','" . $Picid . "')";
$result = mysql_query($sql);

} else {

// update progress in table
$sql =("UPDATE progress SET Quanprogress1='" . $_POST["Quanprogress1"] . "', Qualprogress1='" . $_POST["Qualprogress1"] . "', Attachment1='" . $_POST["Attachment1"] . "' WHERE Picid='" . $Picid . "'");
$result = mysql_query($sql);
echo('Record Updated');

}

$result = mysql_query("SELECT * FROM progress WHERE Picid='$Picid' ");
$row= mysql_fetch_array($result);

}

?> <p><b>1.Target</b></p>
<Table>
<tr>
<td><font size=2>a.i.Quantitative Progress:</font></td>
<td><input type="text" name="Quanprogress1" id="Quanprogress1" class="txtField" value="<?php echo $row['Quanprogress1']; ?>"></td>
<td><font size=2>a.ii.Qualitative Progress: </font></td>
<td><input type="text" name="Qualprogress1" id="Qualprogress1" class="txtField" value="<?php echo $row['Qualprogress1']; ?>"></td>
</tr>
</table>
<p><ENCTYPE="multipart/form-data">c.i.Preformatted Forms: <input type="file" name="Attachment1" id="Attachment1" MAXLENGTH=50 ALLOW="text/*" value="<?php echo $row['Attachment1']; ?>"></p>
<input type="hidden" name="Picid" id="Picid" value="<?php echo $row['Picid']; ?>" >
<input type="hidden" name="Progressid" id="Progressid" value="<?php echo $row['Progressid']; ?>">
<td colspan="2"><input type="submit" name="submit" id="submit" value="Save" class="btnSubmit"></td>
</div>
</form>
</body>
</html>

  • 2 Contributors
  • 1 Reply
  • 499 Views
  • 3 Months Discussion Span
  • Latest Post Latest Post by Johnny1

Dani AI

Generated

This thread shows the common pattern: the file name is recorded in the database but never presented to the user in a usable way. is correct to point at upload handling; the key extra points are (1) browsers will not prefill a file input, so the saved filename must be shown as a separate link or text next to the file chooser, and (2) the server must move and store the uploaded file and then expose a safe URL (or serve it through a download script).

To display/open a saved attachment, render a download link built from the stored filename after verifying the file exists and sanitizing output. Example of how to print a link after fetching the DB row:

$storedRel = '/uploads/' . $row['Attachment1']; // public path
if (!empty($row['Attachment1']) && file_exists($_SERVER['DOCUMENT_ROOT'] . $storedRel)) {
    echo '<a href="' . $storedRel . '" target="_blank" rel="noopener">' . htmlspecialchars($row['Attachment1']) . '</a>';
} else {
    echo 'No attachment';
}

Upload workflow checklist (server side): check the upload error code, sanitize the original filename, generate a unique name to avoid collisions, move the temporary file into a controlled uploads folder (move_uploaded_file), store the final filename/path in the database, and then display the link above. Minimal example of a safe move routine:

$base = preg_replace('/[^A-Za-z0-9._-]/','-', basename($_FILES['Attachment1']['name']));
$newName = uniqid('f_', true) . '-' . $base;
$dest = __DIR__ . '/uploads/' . $newName;
if (is_uploaded_file($_FILES['Attachment1']['tmp_name']) && move_uploaded_file($_FILES['Attachment1']['tmp_name'], $dest)) {
    // save $newName to DB
}

Security and debugging notes: validate file type and size server-side; avoid executing uploaded files (store outside webroot or block execution with server rules); escape filenames on output; check php.ini limits (upload_max_filesize, post_maxsize) and file/directory permissions if the link 404s. Finally, migrate off deprecated mysql* calls to PDO or mysqli with prepared statements to prevent SQL injection and future compatibility problems.

Member Avatar for Johnny1

To start, there is no tag named <ENCTYPE>. So, <ENCTYPE="multipart/form-data"> should have been <form method="post" ENCTYPE="multipart/form-data">. However, you are not allowed to "nest" <form> tags. Immediately after the <body>, I see you opened a <form> tag, which you close at the very end of the page.
The enctype attribute needs to go on first <form> tag. Additionally, when submitting attachments, you must use method='post'. Thus, the correct markup should have been <form method="post" enctype="multipart/form-data" action="<?php echo $_SERVER['SCRIPT_NAME'];?>">.

Also, in PHP, the information for all fields of <input type="file"> end up in $_FILES, not in $_POST (refer to the PHP Manual). So in your insert statement, $_POST["Attachment1"] should be $_FILES['Attachment1']['name']

You may also need to change $Picid = $_GET['Picid']; to $Picid = array_key_exists('Picid',$_POST) ? $_POST['Picdd']: $_GET['Picid'];

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.