File manager - Edit - /home/webapp69.cm.in.th/u69319090014/shop non 014/add_product.php
Back
<?php // add_product.php - Handle product submission with secure image upload (Admin Only) session_start(); require_once 'db.php'; // Access Control check if (!isset($_SESSION['user_id']) || $_SESSION['role'] !== 'admin') { header("Location: login.php"); exit(); } if ($_SERVER['REQUEST_METHOD'] === 'POST') { $name = isset($_POST['name']) ? trim($_POST['name']) : ''; $description = isset($_POST['description']) ? trim($_POST['description']) : ''; $price = isset($_POST['price']) ? floatval($_POST['price']) : 0.0; $category = isset($_POST['category']) ? trim($_POST['category']) : ''; $sizes = isset($_POST['sizes']) ? trim($_POST['sizes']) : ''; $colors = isset($_POST['colors']) ? trim($_POST['colors']) : ''; $stock = isset($_POST['stock']) ? intval($_POST['stock']) : 0; // Check basic parameters if ($name === '' || $price <= 0 || $category === '' || !isset($_FILES['image'])) { header("Location: admin.php?tab=products&error_msg=" . urlencode("กรุณากรอกข้อมูลที่จำเป็นให้ครบถ้วน")); exit(); } // Image Upload Handling $file = $_FILES['image']; if ($file['error'] !== UPLOAD_ERR_OK) { header("Location: admin.php?tab=products&error_msg=" . urlencode("เกิดข้อผิดพลาดในการอัปโหลดรูปภาพ (Error Code: " . $file['error'] . ")")); exit(); } // Validate size (Limit to 5MB) $max_size = 5 * 1024 * 1024; if ($file['size'] > $max_size) { header("Location: admin.php?tab=products&error_msg=" . urlencode("ขนาดไฟล์รูปภาพห้ามเกิน 5MB")); exit(); } // Validate extension $allowed_extensions = ['jpg', 'jpeg', 'png']; $file_info = pathinfo($file['name']); $extension = isset($file_info['extension']) ? strtolower($file_info['extension']) : ''; if (!in_array($extension, $allowed_extensions)) { header("Location: admin.php?tab=products&error_msg=" . urlencode("อนุญาตให้อัปโหลดเฉพาะไฟล์รูปภาพ .jpg, .jpeg, .png เท่านั้น")); exit(); } // Double check MIME type for safety $finfo = finfo_open(FILEINFO_MIME_TYPE); $mime_type = finfo_file($finfo, $file['tmp_name']); finfo_close($finfo); $allowed_mimes = ['image/jpeg', 'image/png', 'image/pjpeg', 'image/x-png']; if (!in_array($mime_type, $allowed_mimes)) { header("Location: admin.php?tab=products&error_msg=" . urlencode("ประเภทของไฟล์รูปภาพไม่ถูกต้อง")); exit(); } // Setup Upload Directory $upload_dir = __DIR__ . '/images'; if (!is_dir($upload_dir)) { mkdir($upload_dir, 0777, true); } // Randomize filename to prevent collisions and security threats $new_filename = time() . '_' . bin2hex(random_bytes(4)) . '.' . $extension; $target_filepath = $upload_dir . '/' . $new_filename; if (move_uploaded_file($file['tmp_name'], $target_filepath)) { $db_image_path = 'images/' . $new_filename; try { // Save product to database using Prepared Statement (SQL Injection Prevention) $stmt = $pdo->prepare(" INSERT INTO products (name, description, price, category, sizes, colors, stock, image) VALUES (:name, :description, :price, :category, :sizes, :colors, :stock, :image) "); $stmt->execute([ ':name' => $name, ':description' => $description, ':price' => $price, ':category' => $category, ':sizes' => $sizes, ':colors' => $colors, ':stock' => $stock, ':image' => $db_image_path ]); header("Location: admin.php?tab=products&success_msg=" . urlencode("เพิ่มสินค้าและอัปโหลดรูปภาพสำเร็จแล้ว")); exit(); } catch (Exception $e) { // If DB insert fails, remove the uploaded file to keep filesystem clean @unlink($target_filepath); header("Location: admin.php?tab=products&error_msg=" . urlencode("เกิดข้อผิดพลาดในการบันทึกข้อมูล: " . $e->getMessage())); exit(); } } else { header("Location: admin.php?tab=products&error_msg=" . urlencode("ล้มเหลวในการจัดเก็บไฟล์ในระบบเซิร์ฟเวอร์")); exit(); } } else { header("Location: admin.php"); exit(); } ?>
| ver. 1.4 |
Github
|
.
| PHP 7.4.33 | Generation time: 0.28 |
proxy
|
phpinfo
|
Settings