Оказывая некоторую проблему в файле move_uploaded с файлом cookie

Question

Я пытаюсь вставить значения формы в базу данных. Если пользователь уже подключился, он будет вставлен в базу данных. Но если не войти первым, я сохранил все поля в cookie, а затем перенаправил его на логин, а затем вернул его на страницу формы, и все будет прекрасно вставлено, но мои файлы не будут перемещены в заданный путь. Предложите, чтобы мой код был указан до сих пор. Ошибка отображения на move_uploaded_file ($ cookie17, $ pat);

<?php 
 
if(isset($_POST['submit']) 
 
{ 
 
$ad_title=$mysqli->real_escape_string($_POST['ad_title']); 
 
$category=$mysqli->real_escape_string($_POST['category']); 
 
$sub_category=$mysqli->real_escape_string($_POST['sub_category']); 
 
$description=$mysqli->real_escape_string($_POST['description']); 
 
$rent_amount=$mysqli->real_escape_string($_POST['rent_amount']); 
 
$rent_security=$mysqli->real_escape_string($_POST['rent_security']); 
 
$contact=$mysqli->real_escape_string($_POST['contact']); 
 
$email=$mysqli->real_escape_string($_POST['email']); 
 
$city=$mysqli->real_escape_string($_POST['city']); 
 
$state=$mysqli->real_escape_string($_POST['state']); 
 
$area=$mysqli->real_escape_string($_POST['area']); 
 
$buy=(isset($_POST['buy'])?1:0); 
 
$sell=(isset($_POST['sell'])?1:0); 
 
$rent=(isset($_POST['rent'])?1:0); 
 
$manufacture=$mysqli->real_escape_string($_POST['company_name']); 
 
$conditions=$mysqli->real_escape_string($_POST['condition']); 
 

 
$rent_option=$mysqli->real_escape_string($_POST['rent_option']); 
 

 
$a=$_FILES['file']['name']; 
 
$path="image/product/$a"; 
 

 
$b=$_FILES['file2']['name']; 
 
$path2="image/product/$b"; 
 

 
$c=$_FILES['file3']['name']; 
 
$path3="image/product/$c"; 
 

 
$d=$_FILES['file4']['name']; 
 
$path4="image/product/$c"; 
 

 
$e=$_FILES['file5']['name']; 
 
$path5="image/product/$c"; 
 

 

 
if(isset($_SESSION['user_id'])){ 
 
$query=$mysqli->query("insert into ads(product_name,category,sub_category,description,image_1,image_2,image_3,image_4,image_5,city,state,rent_amount,rent_option,security_amount,contact_no,email,area,buy,sell,rent,user_id,manufacture,conditions)values('$ad_title','$category','$sub_category','$description','$a','$b','$c','$d','$e','$city','$state','$rent_amount','$rent_option','$rent_security','$contact','$email','$area','$buy','$sell','$rent','$user_id','$manufacture','$conditions')"); 
 
move_uploaded_file($_FILES['file']['tmp_name'],$path) & move_uploaded_file($_FILES['file2']['tmp_name'],$path2) & move_uploaded_file($_FILES['file3']['tmp_name'],$path3) & move_uploaded_file($_FILES['file4']['tmp_name'],$path4) & move_uploaded_file($_FILES['file5']['tmp_name'],$path5); 
 
if($query) 
 
{ 
 

 
echo "success"; 
 
} 
 
}else{ 
 

 

 
    $time = time() + 60; 
 
    setcookie('email',$email,$time); 
 
    setcookie('ad_title',$ad_title,$time); 
 
    setcookie('category',$category,$time); 
 
    setcookie('sub_category',$sub_category,$time); 
 
    setcookie('description',$description,$time); 
 
    setcookie('rent_amount',$rent_amount,$time); 
 
    setcookie('rent_security',$rent_security,$time); 
 
    setcookie('contact',$contact,$time); 
 
    setcookie('city',$city,$time); 
 
    setcookie('state',$state,$time); 
 
    setcookie('area',$area,$time); 
 
    setcookie('buy',$buy,$time); 
 
    setcookie('sell',$sell,$time); 
 
    setcookie('rent',$rent,$time); 
 
    setcookie('manufacture',$manufacture,$time); 
 
    setcookie('condition',$conditions,$time); 
 
    
 
    setcookie('rent_option',$rent_option,$time); 
 
    
 
    setcookie('file',$a,$time); 
 
    setcookie('file2',$b,$time); 
 
    setcookie('file3',$c,$time); 
 
    setcookie('file4',$d,$time); 
 
    setcookie('file5',$e,$time); 
 
    
 
header("Location:product/login.php"); } 
 
} 
 
    
 
if(isset($_COOKIE['email'])){ 
 
\t 
 
\t $email =$_COOKIE['email']; 
 
    $cookie2 = $_COOKIE['ad_title']; 
 
    $cookie3 = $_COOKIE['category']; 
 
    $cookie4 = $_COOKIE['sub_category']; 
 
    $cookie5 = $_COOKIE['description']; 
 
    $cookie6 = $_COOKIE['rent_amount']; 
 
    $cookie7 = $_COOKIE['rent_security']; 
 
    $cookie8 = $_COOKIE['contact']; 
 
    $cookie9 = $_COOKIE['city']; 
 
    $cookie10 = $_COOKIE['state']; 
 
    $cookie11 = $_COOKIE['area']; 
 
    $cookie12 = $_COOKIE['buy']; 
 
    $cookie13 = $_COOKIE['sell']; 
 
    $cookie14 = $_COOKIE['rent']; 
 
    $cookie15 = $_COOKIE['manufacture']; 
 
    $cookie16 = $_COOKIE['condition']; 
 
\t $cookie17 = $_COOKIE['file']; 
 
\t $cookie18 = $_COOKIE['file2']; 
 
    $cookie19 = $_COOKIE['file3']; 
 
\t $cookie20 = $_COOKIE['file4']; 
 
\t $cookie21 = $_COOKIE['file5']; 
 
\t $cookie22 = $_COOKIE['rent_option']; 
 
\t 
 
\t 
 
\t 
 
$pat="image/product/$cookie17"; 
 
$pat2="image/product/$cookie18"; 
 
$pat3="image/product/$cookie19"; 
 
$pat4="image/product/$cookie20"; 
 
$pat5="image/product/$cookie21"; 
 
    
 
\t 
 
\t 
 
\t 
 
\t 
 
$query1=$mysqli->query("insert into ads(product_name,category,sub_category,description,image_1,image_2,image_3,image_4,image_5,city,state,rent_amount,rent_option,security_amount,contact_no,email,area,buy,sell,rent,user_id,manufacture,conditions) 
 
values 
 
('$cookie2','$cookie3','$cookie4','$cookie5','$cookie17','$cookie18','$cookie19','$cookie20','$cookie21', 
 
'$cookie9','$cookie10','$cookie6','$cookie22','$cookie7','$cookie8', 
 
'$email','$cookie11','$cookie12','$cookie13','$cookie14','$user_id','$cookie15','$cookie16')"); 
 
move_uploaded_file($cookie17,$pat)& 
 
move_uploaded_file($cookie18,$pat2)& 
 
move_uploaded_file($cookie19,$pat3)& 
 
move_uploaded_file($cookie20,$pat4)& 
 
move_uploaded_file($cookie21,$pat5); 
 
\t 
 
\t 
 
\t if($query1){ 
 
\t \t 
 
\t \t echo "Succes"; 
 
\t } 
 
\t else{ 
 
\t \t echo "Something went wrong."; 
 
\t } 
 
\t 
 
\t 
 
\t } 
 
\t 
 
?>

Answer 1

PHP временные загрузки сохраняются только до тех пор, сценарий не заканчивается по соображениям безопасности. Итак, вам нужно сначала сохранить файл в каком-то временном месте, потом позже после входа в систему, переместить его или удалить файл через некоторое время.

Но ваш код имеет серьезные проблемы с безопасностью, вы следует изучить, как использовать PHP PDO MySQL Queries, тогда вам нужно применить его правильно. В настоящее время вы избегаете $ _POST, но не куки. Так что вам следует избегать при вставке в БД, в настоящее время он ускользает и в некоторых случаях записывается в файлы cookie. И позже повторное использование. Кроме того, вы должны проверить входные данные и изображение. В целом необходимо провести некоторую проверку. См Easiest Form validation library for PHP?

<?php 
$savePath = 'image/product/'; 
$temporarayPath = 'image/tempupload/'; 
if (isset($_POST['submit'])) { 
    $ad_title = $mysqli->real_escape_string($_POST['ad_title']); 
    $category = $mysqli->real_escape_string($_POST['category']); 
    $sub_category = $mysqli->real_escape_string($_POST['sub_category']); 
    $description = $mysqli->real_escape_string($_POST['description']); 
    $rent_amount = $mysqli->real_escape_string($_POST['rent_amount']); 
    $rent_security = $mysqli->real_escape_string($_POST['rent_security']); 
    $contact = $mysqli->real_escape_string($_POST['contact']); 
    $email = $mysqli->real_escape_string($_POST['email']); 
    $city = $mysqli->real_escape_string($_POST['city']); 
    $state = $mysqli->real_escape_string($_POST['state']); 
    $area = $mysqli->real_escape_string($_POST['area']); 
    $buy = (isset($_POST['buy']) ? 1 : 0); 
    $sell = (isset($_POST['sell']) ? 1 : 0); 
    $rent = (isset($_POST['rent']) ? 1 : 0); 
    $manufacture = $mysqli->real_escape_string($_POST['company_name']); 
    $conditions = $mysqli->real_escape_string($_POST['condition']); 

    $rent_option = $mysqli->real_escape_string($_POST['rent_option']); 


    $a = $_FILES['file']['name']; 
    $b = $_FILES['file2']['name']; 
    $c = $_FILES['file3']['name']; 
    $d = $_FILES['file4']['name']; 
    $e = $_FILES['file5']['name']; 

    if (isset($_SESSION['user_id'])) { 
     $query = $mysqli->query("insert into ads(product_name,category,sub_category,description,image_1,image_2,image_3,image_4,image_5,city,state,rent_amount,rent_option,security_amount,contact_no,email,area,buy,sell,rent,user_id,manufacture,conditions) 
values('$ad_title','$category','$sub_category','$description','$a','$b','$c','$d','$e','$city','$state','$rent_amount','$rent_option','$rent_security','$contact','$email','$area','$buy','$sell','$rent','$user_id','$manufacture','$conditions')"); 
     move_uploaded_file($_FILES['file']['tmp_name'], $savePath . $a); 
     move_uploaded_file($_FILES['file2']['tmp_name'], $savePath . $b); 
     move_uploaded_file($_FILES['file3']['tmp_name'], $savePath . $c); 
     move_uploaded_file($_FILES['file4']['tmp_name'], $savePath . $d); 
     move_uploaded_file($_FILES['file5']['tmp_name'], $savePath . $e); 

     if ($query) { 
      echo "success"; 
     } 
    } else { 
     move_uploaded_file($_FILES['file']['tmp_name'], $temporarayPath . $a); 
     move_uploaded_file($_FILES['file2']['tmp_name'], $temporarayPath . $b); 
     move_uploaded_file($_FILES['file3']['tmp_name'], $temporarayPath . $c); 
     move_uploaded_file($_FILES['file4']['tmp_name'], $temporarayPath . $d); 
     move_uploaded_file($_FILES['file5']['tmp_name'], $temporarayPath . $e); 
     $time = time() + 60; 
     setcookie('email', $email, $time); 
     setcookie('ad_title', $ad_title, $time); 
     setcookie('category', $category, $time); 
     setcookie('sub_category', $sub_category, $time); 
     setcookie('description', $description, $time); 
     setcookie('rent_amount', $rent_amount, $time); 
     setcookie('rent_security', $rent_security, $time); 
     setcookie('contact', $contact, $time); 
     setcookie('city', $city, $time); 
     setcookie('state', $state, $time); 
     setcookie('area', $area, $time); 
     setcookie('buy', $buy, $time); 
     setcookie('sell', $sell, $time); 
     setcookie('rent', $rent, $time); 
     setcookie('manufacture', $manufacture, $time); 
     setcookie('condition', $conditions, $time); 

     setcookie('rent_option', $rent_option, $time); 

     setcookie('file', $a, $time); 
     setcookie('file2', $b, $time); 
     setcookie('file3', $c, $time); 
     setcookie('file4', $d, $time); 
     setcookie('file5', $e, $time); 

     header("Location:product/login.php"); 
    } 
} 

if (isset($_COOKIE['email'])) { 

    $email = $_COOKIE['email']; 
    $cookie2 = $_COOKIE['ad_title']; 
    $cookie3 = $_COOKIE['category']; 
    $cookie4 = $_COOKIE['sub_category']; 
    $cookie5 = $_COOKIE['description']; 
    $cookie6 = $_COOKIE['rent_amount']; 
    $cookie7 = $_COOKIE['rent_security']; 
    $cookie8 = $_COOKIE['contact']; 
    $cookie9 = $_COOKIE['city']; 
    $cookie10 = $_COOKIE['state']; 
    $cookie11 = $_COOKIE['area']; 
    $cookie12 = $_COOKIE['buy']; 
    $cookie13 = $_COOKIE['sell']; 
    $cookie14 = $_COOKIE['rent']; 
    $cookie15 = $_COOKIE['manufacture']; 
    $cookie16 = $_COOKIE['condition']; 
    $cookie17 = $_COOKIE['file']; 
    $cookie18 = $_COOKIE['file2']; 
    $cookie19 = $_COOKIE['file3']; 
    $cookie20 = $_COOKIE['file4']; 
    $cookie21 = $_COOKIE['file5']; 
    $cookie22 = $_COOKIE['rent_option']; 
    $user_id = $_SESSION['user_id']; 

    $pat = $savePath . $cookie17; 
    $pat2 = $savePath . $cookie18; 
    $pat3 = $savePath . $cookie19; 
    $pat4 = $savePath . $cookie20; 
    $pat5 = $savePath . $cookie21; 


    $query1 = $mysqli->query("insert into ads(product_name,category,sub_category,description,image_1,image_2,image_3,image_4,image_5,city,state,rent_amount,rent_option,security_amount,contact_no,email,area,buy,sell,rent,user_id,manufacture,conditions) 
values 
('$cookie2','$cookie3','$cookie4','$cookie5','$cookie17','$cookie18','$cookie19','$cookie20','$cookie21', 
'$cookie9','$cookie10','$cookie6','$cookie22','$cookie7','$cookie8', 
'$email','$cookie11','$cookie12','$cookie13','$cookie14','$user_id','$cookie15','$cookie16')"); 

    rename($temporarayPath . $cookie17, $pat); 
    rename($temporarayPath . $cookie18, $pat2); 
    rename($temporarayPath . $cookie19, $pat3); 
    rename($temporarayPath . $cookie20, $pat4); 
    rename($temporarayPath . $cookie21, $pat5); 

    if ($query1) { 
     echo "Succes"; 
    } else { 
     echo "Something went wrong."; 
    } 
} 

?>