· 8 years ago · Apr 09, 2018, 08:36 PM
1<?php require "connection.php"; ?>
2<?php
3 session_start();
4
5
6 $_SESSION['promosdescriptionSuccess'] = null;
7 $_SESSION['promostitleSuccess'] = null;
8 $_SESSION['uploadstatus'] = null;
9
10 if (!isset($_SESSION['username']) && !isset($_SESSION['password'])) {
11 mysqli_close($connection);
12 header("location:login.php");
13 }
14 $_SESION['uploadstatus'] = null;
15 function sanitizedData($data) {
16 $triminput = trim($data);
17 $striplashesinput = stripslashes($triminput);
18 $htmlcharscape = htmlspecialchars($striplashesinput);
19 $sanitizedData = $htmlcharscape;
20 return $sanitizedData;
21 }
22 function UploadFile($img) {
23 $allowed = array('jpg' => 'image/jpeg' , 'jpeg' => 'image/jpeg' , 'JPG' => 'image/jpg');
24 //print_r($img);
25 if(isset($img)) {
26
27 $filename = $img['name'];
28 $filetype = $img['type'];
29
30 $size = $img['size'];
31 $filetmpname = $img["tmp_name"];
32 $ext = pathinfo($filename , PATHINFO_EXTENSION);
33 $maxSize = 1024 * 1024;
34 if (!array_key_exists($ext , $allowed)) {
35 mysqli_close($connection);
36 $_SESSION['promoserror'] = "<span class=\"center-align\">\n".
37 "<strong class=\"white-text\">Use a jpeg image format!</strong>\n".
38 "</strong>\n";
39 header("location:promos.php");
40 die();
41 }
42 if ($size > $maxSize) {
43 mysqli_close($connection);
44 $_SESSION['promoserror'] = "<span class=\"center-align\">\n".
45 "<strong class=\"white-text\">Use a mininum of 1MB of JPG image!</strong>\n".
46 "</strong>\n";
47 header("location:promos.php");
48 die();
49 }
50 if (in_array($filetype , $allowed)) {
51
52 if (file_exists("../img/home/promos" .$filename )) {
53 unlink("../img/home/promos/" .$filename);
54 move_uploaded_file($filetmpname, "../img/home/promos/" .$filename);
55 $_SESSION['dirpath'] = "img/home/promos/" .$filename;
56 $_SESSION['uploadstatus'] = true;
57 return $filename;
58 } else {
59 move_uploaded_file($filetmpname, "../img/home/promos/" .$filename);
60 $_SESSION['dirpath'] ="img/home/promos/" .$filename;
61 $imgPath = $filename;
62 $_SESSION['uploadstatus'] = true;
63 return $filename;
64 }
65 } else {
66 mysqli_close($connection);
67 $_SESSION['promoserror'] = "<span class=\"center-align\">\n".
68 "<strong class=\"white-text\">Invalid File Type!</strong>\n".
69 "</strong>\n";
70 header("location:promos.php");
71 die();
72 }
73 }
74 }
75 if ($_SERVER['REQUEST_METHOD'] == "POST") {
76 if (isset($_POST['promosaddsubmit'])) {
77
78 #promos title validation and sanitation
79 if (isset($_POST['promostitle'])) {
80
81 if (is_numeric($_POST['promostitle'])) {
82
83 $_SESSION['promoserror'] = "<span class=\"center-align\"><strong class=\"white-text\">Title is invalid!</strong></span>\n";
84 } elseif (!is_numeric($_POST['promostitle'])) {
85
86 #check for first number
87 if(strlen($_POST['promostitle']) > 0 && is_numeric($_POST['promostitle'][0])) {
88
89 mysqli_close($connection);
90 $_SESSION['promoserror']= "<span class=\"center-align\"><strong class=\"white-text\">First character is a number!</strong></span>\n";
91 header("location:promos.php");
92 die;
93 } elseif (strlen($_POST['promostitle']) > 0 && !is_numeric($_POST['promostitle'][0])) {
94 $title = sanitizedData($_POST['promostitle']);
95 $sqlPreventInjection = mysqli_escape_string($connection , $title);
96
97 if (strlen($sqlPreventInjection) <= 50 && strlen($sqlPreventInjection) !== 0) {
98 $_SESSION['promostitleSuccess'] = $sqlPreventInjection;
99
100 } elseif (strlen($sqlPreventInjection) > 50 ) {
101 mysqli_close($connection);
102 $_SESSION['promoserror']= "<span class=\"center-align\"><strong class=\"white-text\">Characters is greater than 50!</strong></span>\n";
103 header("location:promos.php");
104 die;
105 }
106 }
107 }
108 } else {
109 mysqli_close($connection);
110 $_SESSION['promoserror']= "<span>".
111 "<strong class=\"center-align white-text\">"."Fill out pagename!"."</strong></span>\n";
112 header("location:promos.php");
113 die();
114 }
115
116
117 if (isset($_POST['promosdescription'])) {
118 if (is_numeric($_POST['promosdescription'])) {
119 $_SESSION['promoserror'] = "<span class=\"center-align\"><strong class=\"white-text\">Description is invalid!</strong></span>\n";
120 } elseif (!is_numeric($_POST['promosdescription'])) {
121 #check for first number
122 if(strlen($_POST['promosdescription']) > 0 && is_numeric($_POST['promosdescription'][0])) {
123 mysqli_close($connection);
124 $_SESSION['promoserror']= "<span class=\"center-align\"><strong class=\"white-text\">First character is a number!</strong></span>\n";
125 header("location:promos.php");
126 die;
127 } elseif (strlen($_POST['promosdescription']) > 0 && !is_numeric($_POST['promosdescription'][0])) {
128 $description = sanitizedData($_POST['promosdescription']);
129 $sqlPreventInjection = mysqli_escape_string($connection , $description);
130
131 if (strlen($sqlPreventInjection) <= 500 && strlen($sqlPreventInjection) !== 0) {
132 $_SESSION['promosdescriptionSuccess'] = $sqlPreventInjection;
133
134 } elseif (strlen($sqlPreventInjection) > 500 || strlen($sqlPreventInjection) == 0 ) {
135 mysqli_close($connection);
136 $_SESSION['promoserror']= "<span class=\"center-align\"><strong class=\"white-text\">Characters is greater than 100!</strong></span>\n";
137 header("location:promos.php");
138 die;
139 }
140 }
141 }
142 } else {
143 mysqli_close($connection);
144 $_SESSION['promoserror']= "<span>".
145 "<strong class=\"center-align white-text\">"."Fill out description!"."</strong></span>\n";
146 header("location:promos.php");
147 die();
148 }
149
150
151 if (isset($_FILES['promosimg'])) {
152
153 $filePath = UploadFile($_FILES['promosimg']);
154
155 } else if (!isset($_FILES['promosimg'])) {
156
157 mysqli_close($connection);
158 $_SESSION['promoserror'] = "<span class=\"center-align\">\n".
159 "<strong class=\"white-text\">Upload Image!</strong>\n".
160 "</strong>\n";
161 header("location:promos.php");die();
162 }
163 if (isset($_SESSION['promosdescriptionSuccess'])&&
164 isset($_SESSION['promostitleSuccess']) && isset($_SESSION['uploadstatus'])) {
165 $titlepass = $_SESSION['promostitleSuccess'];
166 $descriptionPass = $_SESSION['promosdescriptionSuccess'];
167
168 $pathPass = $_SESSION['dirpath'];
169 //die($pathPass);
170 $sql = "CREATE TABLE IF NOT EXISTS tbl_promos (".
171 "id INT NOT NULL AUTO_INCREMENT,".
172 "title VARCHAR(50) NOT NULL,".
173 "description VARCHAR(100) NOT NULL,".
174 "path VARCHAR(1000) NOT NULL,".
175 "PRIMARY KEY(id)".
176 ")";
177 mysqli_query($connection , $sql);
178 $sql = "INSERT INTO tbl_promos(title , description, path) ".
179 "VALUES('$titlepass' , '$descriptionPass' , '$pathPass')";
180 //die($sql);
181 mysqli_query($connection , $sql);
182
183
184 mysqli_close($connection);
185 $_SESSION['promossuccess'] = "<span class=\"center-align\"><strong class=\"white-text\">Data successfully added</strong></span>\n";
186 header("location:promos.php");die;
187 }
188
189 }
190 } else {
191 header("location:promos.php");
192 die();
193 }
194
195?>