一步一步教你用PHP+MySql搭建网站 No.5 图片上传、故事删除

浏览数：32 / 时间：2015年06月12日

上篇文章中讲到，story.php中的表单提交之后的页面是story_submit.php，我们就看一下story_submit.php是如何完成文章的发表的

老样子，先上代码：

<?php
	# add / modify story record
	include_once('include_fns.php');

	$handle = db_connect();

	$headline = $_REQUEST['headline'];
	$page = $_REQUEST['page'];
	$time = time();

	if ((isset($_FILES['html']['name']) && 
		(dirname($_FILES['html']['type']) == 'text') &&
		is_uploaded_file($_FILES['html']['tmp_name']) )) {
		// if user upload some files, then set the content of the files as the story_text
		$story_text = file_get_contents($_FILES['html']['tmp_name']);
	}else{
		$story_text = $_REQUEST['story_text'];
	}

	$story_text = addslashes($story_text);

	if (isset($_REQUEST['story']) && $_REQUEST['story']!='') {
		# it's an update
		$story = $_REQUEST['story'];

		$query = "update stories 
				  set headline = '$headline',
				  	  story_text = '$story_text',
				  	  page = '$page',
				  	  modified = $time
				  where id = $story";
	}else{
		// it's a new story
		$query = "insert into stories
				  (headline,story_text,page,writer,created,modified)
				  values
				  ('$headline','$story_text','$page','".$_SESSION['auth_user']."',
				  	$time,$time)";
	}

	$result = mysql_query($query);

	if (!$result) {
		# code...
		echo "There was a database error when executing <pre>$query</pre>";
		echo mysql_error();
		exit; 
	}

	if ((isset($_FILES['picture']['name']) && 
		is_uploaded_file($_FILES['picture']['tmp_name']))) {
		# there is uploaded picture
		if (!isset($_REQUEST['story']) || $_REQUEST['story']=='') {
			$story = mysql_insert_id($handle);
			// mysql_insert_id  return the auto generated id used in the last query
		}
		$type = basename($_FILES['picture']['type']);

		switch ($type) {
			case 'jpeg':
			case 'pjpeg':
			case 'png':
			case 'jpg':
				$filename = "images/$story.jpg";
				move_uploaded_file($_FILES['picture']['tmp_name'], '../'.$filename);
				$query = "update stories 
						  set picture = '$filename'
						  where id = $story";
				$result = mysql_query($query);
				break;
			
			default:
				echo 'Invalid picture format:'.$_FILES['picture']['type'];
				break;
		}
	}else{
		// there is no image file to upload or didn't get the file's info
		echo 'Possible file upload attack:';
		echo "filename '".$_FILES['picture']['tmp_name']."'.";
	}
	
	header('Location: '.$_REQUEST['destination']);
?>

我们还是先从整体捋一遍代码：