registrarion form help...
 

in my registration form,i have two php files,one is register.php that is used to connect the database,and post my registration values into database,and another one is upload.php it used to upload the files int to one folder,how can i place these two php files,and get the output from the same form.....

my register.php is:
<?php
session_start();
$link = mysql_connect('localhost', 'root', '');
if (!$link) {
die('Could not connect: ' . mysql_error());
}
$dbselect = mysql_select_db('anand')or die("Can not select ");
if(!$dbselect){
die('Could not connect: ' . mysql_error());
}
if($_REQUEST["Check"] == 1)
{
$companyname = $_POST["companyname"];
$email = $_POST["email"];
$password = $_POST["password"];
$confirmpassword = $_POST["confirmpassword"];
$landlineareacode = $_POST["landlinearecode"];
$landline = $_POST["landline"];
$mobile = $_POST["mobile"];
$contact1 = $_POST["contact1"];
$contact2 = $_POST["contact2"];
$contact3 = $_POST["contact3"];
$contactpin = $_POST["contactpin"];
$corporate1 = $_POST["corporate1"];
$corporate2 = $_POST["corporate2"];
$corporate3 = $_POST["corporate3"];
$corporatepin = $_POST["corporatepin"];
$turnover = $_POST["turnover"];
$help1 = $_POST["help1"];
$help2 = $_POST["help2"];
$help3 = $_POST["help3"];
$profile = $_POST["profile"];
$upload_profile = $_POST["upload_profile"];
$query = "insert into employerstep1(companyname,email,password,confirmpa ssword,landlineareacode,landline,mobile,contact1,c ontact2,contact3,contactpin,corporate1,corporate2, corporate3,corporatepin,turnover,help1,help2,help3 ,profile,upload_profile) values('$companyname','$email','$password','$confi rmpassword','$landlineareacode','$landline','$mobi le','$contact1','$contact2','$contact3','$contactp in','$corporate1','$corporate2','$corporate3','$co rporatepin','$turnover','$help1','$help2','$help3' ,'$profile','$upload_profile')";
}
$result = mysql_query($query);
mysql_close($link);

?>



my upload.php is:

<?php
// Configuration - Your Options
$allowed_filetypes = array('.jpg','.gif','.bmp','.png'); // These will be the types of file that will pass the validation.
$max_filesize = 524288; // Maximum filesize in BYTES (currently 0.5MB).
$upload_path = './files/'; // The place the files will be uploaded to (currently a 'files' directory).

$filename = $_FILES['userfile']['name']; // Get the name of the file (including file extension).
$ext = substr($filename, strpos($filename,'.'), strlen($filename)-1); // Get the extension from the filename.

// Check if the filetype is allowed, if not DIE and inform the user.
if(!in_array($ext,$allowed_filetypes))
die('The file you attempted to upload is not allowed.');

// Now check the filesize, if it is too large then DIE and inform the user.
if(filesize($_FILES['userfile']['tmp_name']) > $max_filesize)
die('The file you attempted to upload is too large.');

// Check if we can upload to the specified path, if not DIE and inform the user.
if(!is_writable($upload_path))
die('You cannot upload to the specified directory, please CHMOD it to 777.');

// Upload the file to your specified path.
if(move_uploaded_file($_FILES['userfile']['tmp_name'],$upload_path . $filename))
echo 'Your file upload was successful, view the file <a href="' . $upload_path . $filename . '" title="Your File">here[/url]'; // It worked.
else
echo 'There was an error during the file upload. Please try again.'; // It failed Sad.

?>
please help me to solve this....

Well before your awnser will be posted, please note that your registration page is not save. I would be able to take over your SQL server and that's not good :)

Please look at this tutorial: Combined Minds > Tutorials > PHP Security: SQL Injection

no man,that two php files are working well and mysql server has no problem too but i need to place those files into one php file....if i paste those files into one file,database post is working,but i cant find uploded files in my upload folder....if my questions are very basic please apologize myself....

Galleeandfarel, i don't think you understood Jim correctly. Though your script might work as you intended, it is byfar unsecure. read the link he posted you will see why.

you need to use this on all of your user inputs. to help prevent people from being able to hack your site with SQL injections.
though to answer your question.
might be your problem? cant' say for sure as i didn't test anything, but by looking at it, your trying to upload the file to a folder called "files" but with the " ./" doesn't that tell the script up 1 directory?
root/
root/site (where your script is located)
root/site/files
root/site/other files
that would attempt to put your uploads into a folder called
root/files/
not the intended
root/site/files
though i may be misinterpreting the "./". i know double periods "../" does, but not sure about a single one.

What he is saying is that your PHP script has a huge SQL Injection Security hole in it. All Variables needed to be entered into a database that come (or dont) from user based input should at the very minimum have the function mysql_real_escape_string enclosed around it.

Unless you want someone to easily drop all the tables in your database. :shrug:

PHP: mysql_real_escape_string - Manual

What he means is it will work at the minute but it is not secure at all.

I would upload the image and then insert the data into the database. Provided you get all the information from the one form, this should work:

Now I dont have tmie to test this or anything but the basic idea is to insert the form data into the db where you tell the user their file was uploaded correctly.

You should really look at fixing the security holes in your script first though.

i have checked in my localhost dude....
it couldnt work....
error is
Parse error: syntax error, unexpected T_ELSE in C:\wamp\www\vgotjobs\success.php on line 61.....

He forgot some curly braces is all. Change;

Edit: He forgot a few actually. That's why omitting them can be problematic. You need an opening curly { after that last IF as well.
-m

Yea, sorry. That was a really quick example to give you an idea of what you needed to do.

Please use php tags.
and please keep the text clean.

Thank you.

hey Jmz,delayedinsanity,
i have joined the code as u said is it tells "The file you attempted to upload is not allowed."
what can i do guyz????

I wouldn't trust a file to be what it says it is, you may want to check out getimagesize() or mime_content_type() to get a definite result. With your method however, your method of getting the file extension breaks if there's multiple periods in the filename, so I'd suggest the following two lines:

-m

no man,actually it works when i run those files separately,problem is i dnt know how can i merge those files??? this is my designing page