Image upload script more cleaner and secure using php 7 oop style. I want to utilize namespaces and make the code on this file uploading script more secure, and cleaner looking, here is what i have so far

it uploads an image and inserts it into a database.

I want to be able to use namespaces within view files, without it looking messy.

i know i can use laravel blade etc, but for the sake of sharpening my php skills, i want to be able to do this from scratch.

Image.php

&lt;?php

require 'Db.php';


class Image{

    private $dbh;
    private $connect;
    public $directory;
    public $uploadfile;




    public function __construct()
    {
        $this-&gt;dbh = new Db();
        $this-&gt;connect =  $this-&gt;dbh-&gt;connect();
        $this-&gt;directory = "uploads/";
    }


    public function upload_image($filename, $image_name)
    {

        $this-&gt;uploadfile = $this-&gt;directory . basename($filename);

        try{
            $stmt = $this-&gt;connect-&gt;prepare("INSERT INTO images (img, image_name) VALUES (:img, :imagename) ");
            $stmt-&gt;bindparam(':img', $this-&gt;uploadfile);
            $stmt-&gt;bindparam(':imagename', $image_name);
            $stmt-&gt;execute();
            return $stmt; 
        }
        catch(PDOExeception $e)
        {
            echo $e-&gt;getMessage();
        }


    }

    public function get_image()
    {
        return $this-&gt;uploadfile;
    }

}


upload_image.php (view file)

    &lt;form action="/ImgUpload.php" enctype="multipart/form-data" method="post"&gt;

          &lt;div class="form-group"&gt;
            &lt;label for="exampleInputFile"&gt;File input&lt;/label&gt;
            &lt;input type="file" name="profile_img" class="form-control-file" id="exampleInputFile" aria-describedby="fileHelp"&gt;
            &lt;input type="text" name="image_name" placeholder="Enter Name Of File" class="mt-3"&gt;
            &lt;small id="fileHelp" class="form-text text-muted"&gt;This is some placeholder block-level help text for the above input. It's a bit lighter and easily wraps to a new line.&lt;/small&gt;
            &lt;button type="submit" class="btn btn-primary"&gt;Submit&lt;/button&gt;
          &lt;/div&gt;

        &lt;/form&gt;


ImgUpload.php

&lt;?php
session_start();
require_once 'Image.php';



if(isset($_FILES['profile_img'])){

    $image = new Image();

    $filename = $_FILES["profile_img"]["name"];
    $realname = "uploads/" . basename($filename);
    $directory = "/Applications/MAMP/htdocs/eliphp1/uploads/";

    $path = $directory . basename($filename);

    $image_name = $_POST['image_name'];


    if($image-&gt;upload_image($realname, $image_name)){

        move_uploaded_file($_FILES["profile_img"]["tmp_name"], $path);

        echo '&lt;img src="'.$image-&gt;get_image().'"&gt;';


    };


};




?&gt;
To elaborate on the answer from Stexxe...


  it can have connection to database ($this->connect of your Image class) as dependency


A database class is different from all other classes. It cannot be created any time on demand. It has to be created only once, connect to a database, and hold this connection all the time. Otherwise numerous connections from the same script will crash your database server. 

So it has to be:

class ImageMapper{

    private $connect;

    public function __construct($connect)
    {
        $this-&gt;connect = $connect;
    }


and called like this:

$dbh = new Db();
$connect =  $dbh-&gt;connect();

$image = new Image($connect);



  manipulation images classes should not expose any information about their inner workings 


Among other things, it means that error reporting should never reveal the actual error to a site user. Therefore you should never ever do anything like die($error) -- which also makes the whole try..catch business misplaced in this code.  So it should be:

public function upload_image($filename, $image_name)
{
    $sql = "INSERT INTO images (img, image_name) VALUES (?, ?)";
    $this-&gt;connect-&gt;prepare($sql)-&gt;execute([$filename, $image_name]);
}


whereas a possible exception thrown by PDO must be caught elsewhere. Learn more from my article on PHP error reporting.

Some other stuff has also been fixed, mostly your extremely confusing way assigning a filename, when you are adding, removing and re-adding the directory name. Some useless variables like $directory and $filename are also removed.