$user_id = $GET['user_id'] returns null when upload file

Question

When i upload a file to my databae i want it to get the user_id, but it is returning null.

I already have made some tests to check if its really returning null and it is once i upload.

It knows which user_id is logged on that upload page.

See my code:

<?php

if(isset($_POST['title']))
{
    //Check file type
    $ext = substr(strrchr(basename($_FILES['file']['name']), '.'), 1);
    if (!in_array($ext, $okExts))
    {
        echo "<p class=\"bad\">Formato Inválido.</p>";
    }
    else
    {
        $movePath = "../".$uploadPath . basename($_FILES['file']['name']); 
        $url = basename($_FILES['file']['name']);
        $title = mysql_escape_string($_POST['title']);
        $description = mysql_escape_string($_POST['description']);
        $user_id = $_GET['user_id'];

        if(move_uploaded_file($_FILES['file']['tmp_name'], $movePath)) 
        {
            //Update Fields
            $fileSQL = "INSERT INTO files (title, description, user_id, url) 
                      VALUES ('$title', '$description', '$user_id','$url')";

            mysql_query($fileSQL,$conn) or die('Error: ' . mysql_error());

            echo "<p class=\"good\">O Arquivo ".basename( $_FILES['file']['name'])." foi enviado.</p>";
        } 
        else
        {
            echo "Ocorreu um erro ao enviar o arquivo, por favor tente novamente!";
        }
    }
}
?>

I take it that you're already fetching user id from DB before running this? I see GET and POST together and I cringe. — Funk Forty Niner, Jul 04 '14 at 16:20
Then, the problem may not be in your posted code, but in the code where you're fetching it from. What does `var_dump($user_id);` reveal when placed after `$user_id = $_GET['user_id'];`? (in your posted code). — Funk Forty Niner, Jul 04 '14 at 16:23
There you go. Show us the code you're using "before" you're uploading, or use `$user_id = $_REQUEST['user_id'];` as Feroz suggested. — Funk Forty Niner, Jul 04 '14 at 16:34
Great, glad to hear it, and you're welcome. Was it by using `$user_id = $_REQUEST['user_id'];`? — Funk Forty Niner, Jul 04 '14 at 16:35
This looks terrifyingly insecure. Are you **sure** your user parameters are [properly escaped](http://bobby-tables.com/php)? — tadman, Jul 04 '14 at 16:40

score 0 · Answer 1 · answered Jul 04 '14 at 19:49

0

Why should not you use $_POST['user_id']; whether you $_POST['title']. To get $_GET['user_id']; you should pass page.php?user_id=36525 with URL.

answered Jul 04 '14 at 19:49

IshaniNet

153
10

$user_id = $GET['user_id'] returns null when upload file

1 Answers1