Unable to upload file by adding

I have a problem with uploadify. it works very well on the client (all functions, such as button, progress, etc. and the file, can be downloaded on the client) but on the hosting (server) the file cannot be downloaded.

on the server, another (button, progress, script to download) works, only the file I want to download cannot be uploaded.

Otherwise, I have some process to insert into the database (file path), I put the sql-insert request in the script for the loading process, the request works, but the file cannot be loaded

my script (upload_file.php):

<?php    

    $file_id         = $_POST['file_id']; 

    if (!empty($_FILES))  
{

    $tempFile   = $_FILES['Filedata']['tmp_name'];  
    $targetPath = $_SERVER['DOCUMENT_ROOT'] . $_REQUEST['folder'] . '/';    
    $targetFile = str_replace('//','/',$targetPath) . $_FILES['Filedata']['name'];

        $destinationFile = "files/". $_FILES['Filedata']['name'];           
        move_uploaded_file($tempFile,$targetFile);



        //additional - query to insert the path

        include("database_connection.php");     

        $query  = "insert into file (file_id,path) values ('$file_id','$destinationFile')";
        $result = mysql_query($query);      

        mysql_close();   
}  ?>

and javascript:

$('#file').uploadify
({
    'uploader'   : '/myweb/shockwaves/uploadify.swf',
    'script'     : '/myweb/process/upload_file.php',
    'cancelImg'  : '/myweb/images/uploadify/cancel.png',
    'folder'     : '/myweb/files',
    'auto'       : true,    
    'buttonText' : 'Upload',
    'scriptData' : {'file_id':'001'}
});

thank:)

+3
source share
1 answer

We need more information, but the possibilities that come to mind:

  • HTML .
  • .
  • .
  • .

, HTML "enctype"

, HTML- enctype="multipart/form-data" .

<form action="" method="POST" enctype="multipart/form-data">

PHP/

/, PHP, , :

<?php
    error_reporting(E_ALL);
    ini_set("display_errors", 1); 
?>

_,

, file_id (.. /), , . , file_id ( , file_id , ).

, , 'scriptData' : {'file_id':'001'}, , file_id 001 . , - : a) , file_id ; b) JS ( , , , ) c ) file_id.

SQL Injection

SQL Injection, . ", , , ", SQL . -, . , , unescaped SQL ( , ), , / -.

+3

All Articles