MySQL中的更新導致文件路徑被刪除，如果沒有上傳

我有一個表單將圖像上傳到我的服務器並將路徑存儲在MySQL中。當我更新記錄時，除非我在文件上傳框中選擇圖像，否則上傳圖像的路徑將從MySQL中刪除。我並不總是需要更新圖像，因此如果在更新表單上未選擇文件，如何防止文件路徑被刪除？另外我知道SQL注入，所以不需要告訴我請！MySQL中的更新導致文件路徑被刪除，如果沒有上傳

這裏是更新表單字段

 <fieldset id="info" class="auto-style1" style="height: 620px; width: 385px;"> 

     <legend id="infoLegend">Member Information</legend> 

     <div id="InfoContent"> <table style="height: 598px; width: 383px;"> 
       <tbody> 

        <tr class="firstname"> 
         <td class="firstname" style="width: 58px">First Name</td> 
         <td class="firstname" style="width: 280px"> 

         <input type="text" name="first_name" value="<?php echo $data2['first_name']?>" style="width: 170px"></td> 
        </tr> 
        <tr class="lastname"> 
         <td class="label" style="width: 58px">Last Name</td> 
         <td class="field" style="width: 280px"> 

         <input type="text" name="last_name" id="lastname" value="<?php echo $data2['last_name']?>" style="width: 171px"> 
         </td></tr> 
         <tr class="teamname"> 
         <td class="teamname" style="width: 58px">Team Name</td> 
         <td class="teamname" style="width: 280px"> 

         <input type="text" name="team_name" id="teamname" value="<?php echo $data2['team_name']?>" style="width: 170px"> 
         <br> 
      </td> 
        </tr> 

        <tr class="typeName"> 
        <td class="label" style="width: 58px">Registration</td> 
        <td class="field" style="width: 280px"> 
        <input type="text" name="registration" id="jerseybrand" value="<?php echo $data2['registration']?>" style="width: 170px">      
        </td> 
        </tr> 
        <tr class="paystatus"> 
        <td class="paystatus" style="width: 58px">Payment Status</td> 
        <td class="paystatus" style="width: 280px"> 
        <input type="text" name="pay_status" id="paystatus" value="<?php echo $data2['pay_status']?>" style="width: 170px"> 
        <br> 
        </td> 
        </tr> 
        <tr class="physical"> 
        <td class="physical" style="width: 58px">Physical</td> 
        <td class="physical" style="width: 290px"> 
        <input type="text" name="physical" id="physical" value="<?php echo $data2['physical']?>"> 
        </tr style="width: 170px"> 
        <tr class="photo"> 
        <td class="photo" style="width: 58px">Photo Taken</td> 
        <td class="photo" style="width: 290px"> 
        <input type="text" name="photo" id="photo" value="<?php echo $data2['photo']?>"> 
        </tr style="width: 170px"> 

        <tr> 
        <td> 
        Notes 
        </td> 
        <td class="notes" style="width: 280px"> 
        <textarea name="notes" id="notes" class="auto-style1" style="height: 35px; width: 215px"><?php echo $data2['notes']?></textarea> 
        <br><br> 
        </td></tr> 
        <tr class="teamlogo"> 
        <td class="teamlogo" style="width: 58px">Team Logo</td> 
        <td class="teamlogo" style="width: 280px"> 
        <img name="logo_image "src="<?php echo $data2['logo_src']?>" id="logoimage" height="100" width="100"> 
        </td width="116"> 

        <input type="hidden" name="logo_src" value="<?php echo $data2['logo_src']?>" id="logosrc"/> 
        </tr> 
        <tr class="logosrc"> 
         <td class="logosrc" style="width: 58px">Change Logo</td> 
         <td class="logosrc" style="width: 280px"> 

         <select name="team_name" id="dd" onChange="swapImage()" style="width: 150px"> 
    <option value="" title="logos/cheerlogoleft.jpg">SELECT</option> 
    <option value="COUGARS" title="logos/cougars2013.jpg" >Cougars</option> 
    <option value="FALCONS" title="logos/falcons2013.jpg" >Falcons</option> 
    <option value="GREEN VALLEY KNIGHTS" title="logos/gvklogo2013.png">Green Valley Knights</option> 
    <option value="LONGHORNS" title="logos/longhorns2013.jpg">Longhorns</option> 
    <option value="MUSTANGS" title="logos/mustangs2013.jpg">Mustangs</option> 
     <option value="NW NINERS" title="logos/nwniners2013.jpg">NW Niners</option> 
     <option value="REBELS" title="logos/rebels2013.jpg">Rebels</option> 
     <option value="WILDCATS" title="logos/wildcats2013.jpg">Wildcats</option> 
</select> 

</td> 
        </tr> 
<tr class="photo"> 
        <td class="photo" style="width: 58px">Change Photo</td> 
        <td class="photo" style="width: 290px"> 
        <input type="file" name="member_photo" "id="cheerphoto"/> 
        </tr style="width: 170px"> 

      </tbody> 
      </table> 
      </div> 
      </fieldset> 

    </td><td id="righttdhw" style="width: 517px; height: 141px;"> 
     <fieldset id="info" style="width: 260px; height: 183px"> 

     <legend id="infoLegend">Member Photo</legend> 

     <div id="memberphoto"> 
     <table style="height: 156px; width: 260px;"> 
     <tbody> 
       <tr class="memberphoto"> 
        <td class="field" style="width: 269px; height: 132px; text-align: center;"> 
        <img name="member_photo" src="<?php echo $data2['member_photo']?>" id="memberphoto" height="150" width="250" > 

        </td> 
        </tr>

和process_edit.php文件

<?php 
$id=$_POST['id']; 
//This is the directory where images will be uploaded and saved 
$target = "uploads/cheer/"; 
$target = $target . basename($_FILES['member_photo']['name']); 

//This gets all the form data// 

//----------MEMBER INFO----------// 
$team_name=!empty($_POST['team_name'])? $_POST['team_name'] : ''; 
$first_name=!empty($_POST['first_name'])? $_POST['first_name'] : ''; 
$last_name=!empty($_POST['last_name'])? $_POST['last_name'] : ''; 
$registration=!empty($_POST['registration'])? $_POST['registration'] : ''; 
$pay_status=!empty($_POST['pay_status'])? $_POST['pay_status'] : ''; 
$physical=!empty($_POST['physical'])? $_POST['physical'] : ''; 
$photo=!empty($_POST['photo'])? $_POST['photo'] : ''; 
$notes=!empty($_POST['notes'])? $_POST['notes'] : ''; 
$logo_src=!empty($_POST['logo_src'])? $_POST['logo_src'] : ''; 

//----------IMAGES----------// 
$pic=!empty($_FILES['member_photo']['name'])? $_FILES['member_photo']['name'] : ''; 

//----------CONNECT TO DATABASE----------// 
include 'elite_connect.php'; 

//----------WRITES DATA TO DATABASE----------// 
mysql_query("UPDATE cheer SET team_name='$team_name', first_name='$first_name', last_name='$last_name', registration='$registration', pay_status='$pay_status', physical='$physical', photo='$photo', logo_src='$logo_src', notes='$notes', member_photo='$target' 
WHERE `id` = '$id'"); 
//----------DISPLAYS MYSQL ERRORS----------// 
print_r($_POST); 
echo mysql_error(); 
//----------WRITES PHOTO TO SERVER----------// 
if(move_uploaded_file($_FILES['member_photo']['tmp_name'], $target)) 
{ 
//----------TELLS IF ALL IS OK----------// 
echo "The file ". basename($_FILES['member_photo']['name']). "has been uploaded!"; 
} 
else { 
//----------GIVES AN ERROR IF IT'S NOT----------// 
?><br/><?php 
echo "Sorry, there was a problem uploading your image."; 
} 
?>

來源

2013-07-12 user2447848

我會更擔心的是張開的刺目[SQL注入攻擊]的代碼（http://bobby-tables.com）孔前擔心幾個領域被毀壞。數據庫調用完全沒有任何錯誤處理，並且缺少對文件上傳的成功檢查，這也是非常糟糕的。 –

@MarcB真的嗎？我真的不關心這些，你是否會進入我的辦公室，拿着我的筆記本電腦運行MySQL，並且這種形式僅用於永遠不會上網並執行SQL注入攻擊的情況？我認真地說我不關心它。 – user2447848

我沒看到'member_photo的輸入字段？ –

改爲嘗試這種方法。這將更新您的數據庫僅當文件被正確上傳：

//----------CONNECT TO DATABASE----------// 
include 'elite_connect.php'; 

//----------WRITES DATA TO DATABASE----------// 
mysql_query("UPDATE cheer SET team_name='$team_name', first_name='$first_name', last_name='$last_name', registration='$registration', pay_status='$pay_status', physical='$physical', photo='$photo', logo_src='$logo_src', notes='$notes' 
WHERE `id` = '$id'"); 
//----------DISPLAYS MYSQL ERRORS----------// 
print_r($_POST); 
echo mysql_error(); 
//----------WRITES PHOTO TO SERVER----------// 
if(move_uploaded_file($_FILES['member_photo']['tmp_name'], $target)) 
{ 
//----------TELLS IF ALL IS OK----------// 
echo "The file ". basename($_FILES['member_photo']['name']). "has been uploaded!"; 
mysql_query("UPDATE cheer SET member_photo='$target' 
WHERE `id` = '$id'"); 
} 
else { 
//----------GIVES AN ERROR IF IT'S NOT----------// 
?><br/><?php 
echo "Sorry, there was a problem uploading your image."; 
}

來源

2013-07-12 19:50:40

神話般的，簡單的，快速的，它的工作原理。感謝您關注主題，而不是去注入sql注入路線！ – user2447848

要分配且不論其插入$目標實際上是被髮送。在插入文件之前，您需要檢查文件是否正在發送（就像您正在處理正常輸入字段一樣）。

http://php.net/manual/en/function.is-uploaded-file.php

從那裏，你可以做一個有條件的插入，插入一個包含文件一個沒有或包括存儲網址作爲一種價值，只是換一個隱藏字段，在如果圖像尚未上傳。

來源

2013-07-12 19:45:06 hendr1x

MySQL中的更新導致文件路徑被刪除，如果沒有上傳

回答

相關問題