pastemyst | PHP error for reddit

PHP error for reddit

PHP

PHPcopy raw

<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);
include('insert.php');
// Dont use the root account for anything other than administration
// No check here that the connection is successful
$conn = mysqli_connect('localhost', 'root', '', 'database');
if(isset($_POST['name']) && isset($_POST['slogan'])){
    $name = $_POST['name'];
    $slogan = $_POST['slogan'];
    $path = ($_FILES['img']['name']);
    // NEVER use unchecked user input in query without parameterization. This code is vulnerable to sql injection
    $sql = "INSERT INTO paths VALUES ('$name', '$slogan', '$path')";

mysqli_query($conn, $sql);
    $targetdir = "images/";
    // What is the point of basename() here? And what if different users upload a file called logo.png?
    $target = $targetdir . basename($_FILES['img']['name']);
    // Did the file upload even succeed?! Read the manual for how to correctly handle file uploads!
    if(move_uploaded_file($_FILES['img']['tmp_name'], $target)) {
        header('Location: index.php'); 
        exit();
    } else {
        header('Location: err.php');
        exit();
    }
    
    mysqli_close($conn);
}
//the html form below from another file =>
<form enctype="multipart/form-data" action="newfile.php" method="post">

<input type="hidden" name="MAX_FILE_SIZE" value="512000" />
<input type="text" name="name" id="name" placeholder="Your Brand here" required><br>
<input type="text" name="slogan" id="slogan" placeholder="Your Slogan here" required><br>
<input type="file" name="img" id="img" >
<input type="submit" value="Submit">
</form>

created at:

stats: 38 lines, 178 words, 1.62kb