We need more information, but the possibilities that come to mind:
, HTML "enctype"
, HTML- enctype="multipart/form-data" .
<form action="" method="POST" enctype="multipart/form-data">
PHP/
/, PHP, , :
<?php
error_reporting(E_ALL);
ini_set("display_errors", 1);
?>
_,
, file_id (.. /), , . , file_id ( , file_id , ).
, , 'scriptData' : {'file_id':'001'}, , file_id 001 . , - : a) , file_id ; b) JS ( , , , ) c ) file_id.
SQL Injection
SQL Injection, . ", , , ", SQL . -, . , , unescaped SQL ( , ), , / -.