I finally got my upload form and code that uploads to db. I used tutorial from this site.As I am php newbie, I want to know how secure this code is and if it is not secure at all (which I am almost sure of...) could someone tell me how to make it secure. This upload should be only for pdf, jpeg, jpg, doc files. Also this upload will be available to public.<form method=post enctype=multipart/form-data><table width=350 border=0 cellpadding=1cellspacing=1 class=box><tr><td>please select a file</td></tr><tr><td><input type=hidden name=MAX_FILE_SIZEvalue=16000000><input name=userfile type=file id=userfile> </td><td width=80><input name=uploadtype=submit class=box id=upload value= Upload ></td></tr></table></form></body></html><?phpif(isset($_POST['upload'])&&$_FILES['userfile']['size']>0){$fileName = $_FILES['userfile']['name'];$tmpName  = $_FILES['userfile']['tmp_name'];$fileSize = $_FILES['userfile']['size'];$fileType = $_FILES['userfile']['type'];$fileType=(get_magic_quotes_gpc()==0 ? mysql_real_escape_string($_FILES['userfile']['type']) : mysql_real_escape_string(stripslashes ($_FILES['userfile'])));$fp      = fopen($tmpName, 'r');$content = fread($fp, filesize($tmpName));$content = addslashes($content);fclose($fp);if(!get_magic_quotes_gpc()){    $fileName = addslashes($fileName);}$con = mysql_connect('localhost', 'root', 'root') or die(mysql_error());$db = mysql_select_db('olearyinternational', $con);if($db){$query = INSERT INTO upload (name, size, type, content ) .VALUES ('$fileName', '$fileSize', '$fileType', '$content');mysql_query($query) or die('Error, query failed'); mysql_close();echo <br>File $fileName uploaded<br>;}else { echo file upload failed; }} ?>
PHP upload to database
php;mysql