0

I am willing to upload the image attachment file to wordpress content upload folder and as well as adding data to the custom table of wordpress. Both of the function work fine separately but cant run together in a class function. Please help me on this. It is a plugin activated for custom post that contain custom form.

 public function __construct() {
        $mainPageHook = add_action('init', array($this, 'profilePost'));  
        add_action("admin_init",array($this, 'profileMeta'));
        add_action("load-{$mainPageHook}", array($this, 'mainPageAssets'));
        add_action("save_post", array($this, 'save_custom_fields') );
        add_action("save_post", array($this, 'handle_upload') );
        add_action('enqueue_block_editor_assets', array($this, 'adminAssets'));
    } 

My form function

public function profileMetaPost(){
        ?>
        <div class="container">
            <h1>User Profiles Registration</h1>
            <form action="" method="post" enctype="multipart/form-data">
                <div class="row">
                    <div class="col-25">
                        <label for="fname">First Name</label>
                    </div>
                    <div class="col-75">
                        <input type="text" id="fname" name="first_name"  placeholder="Your name..">
                    </div>
                    <div class="col-25">
                        <label for="subject">Short Description</label>
                    </div>
                    <div class="col-75">
                        <textarea id="short_description" name="short_description" placeholder="Write short Description about your role" style="height:200px"></textarea>
                    </div>
                    <div class="col-25">
                        <label for="position">Position</label>
                    </div>
                    <div class="col-75">
                        <input type="text" id="fname" name="position" placeholder="Your Position">
                    </div>
                    <div class="col-25">
                        <label for="social-media-link">Social Media Link</label>
                    </div>
                    <div class="col-75">
                        <input type="text" id="fname" name="social-media-link" placeholder="Your name..">
                    </div>
                    <div class="col-25">
                        <label for="image">Upload Your Image</label>
                    </div>
                    <div class="col-75">
                        <input type="file" id="lname" name="image" placeholder="Your last name..">
                    </div>
                </div>
                <div class="row">
                    <input type="submit" value="Submit">
                </div>
            </form>
         </div>
        <?php }

handle upload function:

public function handle_upload($post_id){
        if ( ! function_exists( 'wp_handle_upload' ) ) {
            require_once( ABSPATH . 'wp-admin/includes/file.php' );
        }
        
        $uploadedfile = $_FILES['image'];
        
        $upload_overrides = array( 'test_form' => false );
        
        $movefile = wp_handle_upload( $uploadedfile, $upload_overrides );
        
        if ( $movefile && ! isset( $movefile['error'] ) ) {
            echo "File is valid, and was successfully uploaded.\n";
            var_dump( $movefile );
        } else {
            /**
             * Error generated by _wp_handle_upload()
             * @see _wp_handle_upload() in wp-admin/includes/file.php
             */
            echo $movefile['error'];
        }
        echo 'word';
    }

My database saving function

public function save_custom_fields($post_id){
        $name = $_POST['first_name'];
        $short_description = $_POST['short_description'];
        $position = $_POST['position'];
        $image = $_POST['image'];

        
        global $wpdb;
        $wpdb -> insert(
            $wpdb -> prefix . 'profile_info',
            [
                'first_name' => $name,
                'short_description' => $short_description,
                'position' => $position,
                'image' => $image,

            ]
        );
    }
  • Your database insert is putting unsanitized values into the database. Fix that first. https://stackoverflow.com/questions/21775774/security-risks-caused-by-unsanitized-user-input-other-than-xss-and-sql-injecti – Howard E Apr 24 '22 at 16:03

0 Answers0