Page taking too long to load
<p>I find it very difficult to comprehend why one of my pages is taking long before displaying its content. The code on the page is as follows.</p>

<p>Please, advise what could be wrong and if the code is secure. If not how to fix it.</p>

<pre><code>&lt;?php

//open database
    include("includes/db_connect.php");
//require("includes/mysql_conn.php");

    // Check to see if the type of file uploaded is a valid image type .........................
function is_valid_type($file)
{
    // This is an array that holds all the valid image MIME types
    // These are the same for all file upload boxes
    $valid_types = array("image/jpg", "image/jpeg", "image/bmp", "image/gif");

    // This is an array that holds all valid image extensions
    // These are the same for all file upload boxes
    $valid_exts = array('jpg', 'jpeg', 'bmp', 'gif');

    // This check is optional
    if(!in_array($file['type'], $valid_types))
        return 0;

    // Get the extension from the uploaded filename
    $upload_ext = pathinfo($file['name'], PATHINFO_EXTENSION);

    // This check is essential for security
    if(!in_array($upload_ext, $valid_exts))
        return 0;

    return 1;
}  
//...................................................................................................    
    // Just a short function that prints out the contents of an array in a manner that's easy to read
    // I used this function during debugging but it serves no purpose at run time for this example
    function showContents($array)
    {
        echo "&lt;pre&gt;";
        print_r($array);
        echo "&lt;/pre&gt;";
    }

    // Set some constants

    // This variable is the path to the image folder where all the images are going to be stored
    // Note that there is a trailing forward slash
    $TARGET_PATH = "images/";

    // Get our POSTed variables
    $ctitle = $_POST['ctitle'];
    $csubject = $_POST['csubject'];
    $creference = $_POST['creference'];
    $cyear = $_POST['cyear'];
    $cobjecttype = $_POST['cobjecttype'];
    $cmaterial = $_POST['cmaterial'];
    $ctechnic = $_POST['ctechnic'];
    $cwidth = $_POST['cwidth'];
    $cheight = $_POST['cheight'];
    $cperiod = $_POST['cperiod'];
    $cmarkings = $_POST['cmarkings'];
    $cdescription = $_POST['cdescription'];
    $csource = $_POST['csource'];
    $cartist = $_POST['cartist'];
    $image = $_FILES['image'];

// Build our target path full string. This is where the file will be moved do
// i.e. images/picture.jpg
$target_path_1 = $TARGET_PATH . $image['name'];

    // Sanitize our inputs
    $ctitle = mysql_real_escape_string($ctitle);
    $csubject= mysql_real_escape_string($csubject);
    $creference = mysql_real_escape_string($creference);
    $cyear = mysql_real_escape_string($cyear);
    $cobjecttype = mysql_real_escape_string($cobjecttype);
    $cmaterial = mysql_real_escape_string($cmaterial);  
    $ctechnic = mysql_real_escape_string($ctechnic);
    $cwidth = mysql_real_escape_string($cwidth);    
    $cheight = mysql_real_escape_string($cheight);
    $cperiod = mysql_real_escape_string($cperiod);
    $cmarkings = mysql_real_escape_string($cmarkings);  
    $cdescription = mysql_real_escape_string($cdescription);
    $csource = mysql_real_escape_string($csource);
    $cartist = mysql_real_escape_string($cartist);
    $image['name'] = mysql_real_escape_string($image['name']);

    // Make sure all the fields from the form have inputs
    if ( $ctitle == "" || $csubject == "" || $creference == "" || $cyear == "" || $cobjecttype == "" || $cmaterial == "" || $ctechnic == "" || $cwidth == "" || $cheight == "" || $cperiod == "" || $cmarkings == "" || $cdescription == "" || $csource == "" || $cartist == "" || $image['name'] == "")
    {
        echo "All fields are required";

        exit;
    }

// Check to make sure that our file is actually an image
// You check the file type instead of the extension because the extension can easily be faked
if (!is_valid_type($image))
{
         echo "You must upload a jpeg, gif, or bmp";

         exit;
}  

// Here we check to see if a file with that name already exists
// You could get past filename problems by appending a timestamp to the filename and then continuing
if (file_exists($target_path_1))
{
        echo "A file with that name already exists";

        exit;
}  

// Lets attempt to move the file from its temporary directory to its new home
if (
    move_uploaded_file($image['tmp_name'], $target_path_1)
)
{
         // NOTE: This is where a lot of people make mistakes.
         // We are *not* putting the image into the database; we are putting a reference to the file's location on the server
         $sql = "insert into collections (ctitle, csubject, creference, cyear, cobjecttype, cmaterial, ctechnic, cwidth, cheight, cperiod, cmarkings, cdescription, csource, cartist, cfilename) values ('$ctitle', '$csubject', '$creference', '$cyear', '$cobjecttype', '$cmaterial', '$ctechnic', '$cwidth', '$cheight', '$cperiod', '$cmarkings', '$cdescription', '$csource', '$cartist', '" . $image['name'] . "')";
         $result = mysql_query($sql) or die ("Could not insert data into DataBase: " . mysql_error());

         exit;
}
else
{
         // A common cause of file moving failures is because of bad permissions on the directory attempting to be written to
         // Make sure you chmod the directory to be writeable

       echo "Could not upload file. Check read/write persmissions on the directory";

         exit;
}  
    ?&gt;
</code></pre>

<p>And my database connection code:</p>

<pre><code>&lt;?php
//set connection variables
$host = "localhost";
$username = "joseph";
$password = "";
$db_name = "collectionsdb"; //database name

//connect to mysql server
$mysqli = new mysqli($host, $username, $password, $db_name);

//check if any connection error was encountered
if(mysqli_connect_errno()) {
    echo "Error: Could not connect to database.";
    exit;
}
?&gt;
</code></pre>

<p>Thanx.</p>

<p>Joseph</p>
