-1

I'm using this code in my other table and it work fine but when I use it on product table will not add new product before I did the code I used XAMPP to insert data but now created a form the same as the other table and I want to make a dropdown menu that take data form prdct_cat a but the data will not go to data base only the image I choose will go the file not to database table.

My php connecting and the functions:

<?php

    class Pro
    {
        private $servername = "localhost";
        private $username   = "root";
        private $password   = "";
        private $dbname     = "cart_system";
        public  $con;


        // Database Connection 
        public function __construct()
        {
            try {
            $this->con = new mysqli($this->servername, $this->username, $this->password, $this->dbname);    
            } catch (Exception $e) {
            echo $e->getMessage();
            }
        }

        // Insert Product
        public function insertData($name,$price,$qty,$code,$cat, $file)
        {   
            $allow = array('jpg', 'jpeg', 'png');
            $exntension = explode('.', $file['name']);
            $fileActExt = strtolower(end($exntension));
            $fileNew = rand() . "." . $fileActExt;  // rand function create the rand number 
            $filePath = 'uploads/'.$fileNew; 
            
            if (in_array($fileActExt, $allow)) {
                      if ($file['size'] > 0 && $file['error'] == 0) {
                    if (move_uploaded_file($file['tmp_name'], $filePath)) {
                $query = "INSERT INTO product(product_name, product_price, product_qty,product_image,product_code,prdct_cat)
                    VALUES('$name','$price','$qty','$fileNew','$code','$cat')";
                $sql = $this->con->query($query);
                if ($sql==true) {
                   return true;
                }else{
                  return false;
                }               
                }
              }
           }
        }

        // Fetch Product records for show listing

        public function displayData()
        {
            $sql = "SELECT * FROM product";
            $query = $this->con->query($sql);
            $data = array();
            if ($query->num_rows > 0) {
            while ($row = $query->fetch_assoc()) {
                $data[] = $row;
            }
            return $data;
            }else{
            return false;
            }
        }

        // delete form Product
        public function delData($id)
        {   
                $query = "DELETE FROM product WHERE id = $id";
                $sql = $this->con->query($query);
                if ($sql==true) {
                   return true;
                }else{
                  return false;
                }               

           
        }

    }
?>

My add.php:

<?php

// Include database file
include 'DbConnection.php';

$Obj_pro = new Pro();

// Insert Record in product table
if(isset($_POST['submit'])) {

    $name = $_POST['name'];
    $price = $_POST['price'];
    $qty = $_POST['qty'];
    $code = $_POST['code'];
    $cat = $_POST['cat'];
    $file = $_FILES['img'];
    $insertData = $Obj_pro->insertData($name, $price, $qty, $code, $cat, $file);

    if ($insertData){
        header("Location:../pro.php");
      
    }else{
        return false;
    }

}
?>
<!DOCTYPE html>
<html >
  <head>
    <title>إضافة منتج جديد</title>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css">
    <link rel="stylesheet" href="https://pro.fontawesome.com/releases/v5.10.0/css/all.css"/>
    <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js"></script>
    <script src="https://maxcdn.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"></script>
  </head>
  <body class="bg-dark"> 
    <div class=" card text-center" style="padding:15px;" >
      <h4>اضافة منتح جديد في الموقع</h4>
    </div><br><br> <br><br> <br>
    <div class="container">
      <form method="POST" action="add.php" enctype="multipart/form-data">
        <div class="form-group text-right text-light">
          <label for="name">:اسم المنتج</label>
          <input type="text" class="form-control text-right" name="name" placeholder="الرجاء كتابة المنتج" required="">
        </div>
        <div class="form-group text-right text-light">
          <label for="username">:السعر</label>
          <input type="text" class="form-control text-right" name="price" placeholder="الرجاء كتابة السعر" required="">
        </div>
        <div class="form-group text-right text-light">
          <label for="username">:الكمية</label>
          <input type="text" class="form-control text-right" name="qty" placeholder="الرجاء كتابة الكمية" required="">
        </div>
        <div class="form-group text-right text-light">
          <label for="username">:الكود</label>
          <input type="text" class="form-control text-right" name="code" placeholder="الرجاء كتابة الكود" required="">
        </div>
        <div class="form-group text-right text-light">
          <label for="username">:التصنيف</label>
          <input type="text" class="form-control text-right" name="cat" placeholder="الرجاء كتابة التصنيف" >
          
        </div>
        <div class=" text-right form-group text-light">
          <label for="profile_image"> إضافة صورة</label>
          <input type="file" class="form-control" name="img" required=""> <br>
          <a href="../pro.php"   class="btn btn-light btn-right">إلغاء</a>
          <input type="submit" name="submit" class="btn btn-danger" style="float:right;" value="إضافة"></a>
        </div>
      </form>
    </div>
  </body>
</html>

database image

category image

Your Common Sense
  • 154,967
  • 38
  • 205
  • 325
  • See that `try..catch` thing you're doing in your constructor? [Don't do that](https://phpdelusions.net/delusion/try-catch) – Phil May 30 '22 at 04:46
  • **Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/32391315) – Dharman May 30 '22 at 14:12

0 Answers0