$filename = $_POST['imageq'];
$filename = mysql_real_escape_string($filename);

if (!$bonushsystemconnect)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("bonush_sy6", $bonushsystemconnect);

// I can inject anything i want here
$imageresult = mysql_query('SELECT id FROM isearch WHERE imageurl="'.$filename.'"');

if(mysql_num_rows($imageresult) > 0) {
print "Already In DB";
end;
}else{
 //congrats! you added an apple to the basket.
                                
$ran = md5(uniqid(mt_rand(), true));

$size = getimagesize($filename);
 
switch ($size['mime']) {
    case "image/gif":
        $type= ".gif";
        break;
    case "image/jpeg":
        $type= ".jpg";
        break;
    case "image/png":
        $type= ".png";
        break;
    case "image/bmp":
        $type= ".bmp";
        break;
} 


$test = $ran;
$test = $test.''.$type;

$fh = fopen("$test", 'w') or die("can't open file");

if($fh==false)
    die("unable to create file");


if(!@copy ($filename,$test))
{
    $errors= error_get_last();
    echo "COPY ERROR: ".$errors['type'];
    echo "<br />\n".$errors['message'];
} else {
    echo "File copied from remote!";


// AND HERE
$sql='INSERT INTO isearch (site, imageurl, oururl, keywords) VALUES ("Peter", "'.$filename.'", ".$test.'", "lol")';

if (!mysql_query($sql, $bonushsystemconnect))
  {
  die('Error: ' . mysql_error())
  }
echo "1 record added";
 }
}