Ultra File Manager

Edit: /home/u523034047/domains/nainitalfloweritech.com/public_html/admin/insert-product.php

<?php
session_start();
include('include/config.php');
include('include/admin-menu.php');

if (empty($_SESSION['alogin'])) {
    header('Location: index.php');
    exit();
}

if (isset($_POST['submit'])) {

// ===== Sanitize Numbers =====
    $category  = intval($_POST['category']);
    $subcategory = intval($_POST['subcategory']);
    $price = intval($_POST['productprice']);
    $pricebd = intval($_POST['productpricebd']);
    $shipping = intval($_POST['productShippingcharge']);

// ===== Image Validation FIRST =====
    $allowed = ['jpg','jpeg','png','webp'];

$ext1 = strtolower(pathinfo($_FILES['productimage1']['name'], PATHINFO_EXTENSION));
    $ext2 = strtolower(pathinfo($_FILES['productimage2']['name'], PATHINFO_EXTENSION));
    $ext3 = strtolower(pathinfo($_FILES['productimage3']['name'], PATHINFO_EXTENSION));

if (!in_array($ext1,$allowed) || !in_array($ext2,$allowed)) {
        $_SESSION['msg'] = "Only JPG, PNG, WEBP allowed!";
        header("Location: insert-product.php");
        exit();
    }

// ===== Better Image Naming =====
    $image1 = time().'_1.'.$ext1;
    $image2 = time().'_2.'.$ext2;
    $image3 = !empty($ext3) ? time().'_3.'.$ext3 : '';

// ===== Prepare Statement =====
    $stmt = $con->prepare("
        INSERT INTO products
        (category, subCategory, productName, productCompany,
         productPrice, productPriceBeforeDiscount,
         productDescription, shippingCharge,
         productAvailability, productImage1, productImage2, productImage3)
        VALUES (?,?,?,?,?,?,?,?,?,?,?,?)
    ");

$stmt->bind_param(
        "iissiisissss",
        $category,
        $subcategory,
        $_POST['productName'],
        $_POST['productCompany'],
        $price,
        $pricebd,
        $_POST['productDescription'],
        $shipping,
        $_POST['productAvailability'],
        $image1,
        $image2,
        $image3
    );

if ($stmt->execute()) {

$productid = $stmt->insert_id;
        $dir = "productimages/$productid";

if (!is_dir($dir)) {
            mkdir($dir, 0777, true);
        }

move_uploaded_file($_FILES['productimage1']['tmp_name'], "$dir/$image1");
        move_uploaded_file($_FILES['productimage2']['tmp_name'], "$dir/$image2");

if(!empty($image3)){
            move_uploaded_file($_FILES['productimage3']['tmp_name'], "$dir/$image3");
        }

$_SESSION['msg'] = "Product inserted successfully!";
    } else {
        $_SESSION['msg'] = "Insert failed!";
    }

header("Location: insert-product.php");
    exit();
}
?>

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Insert Product | Admin</title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<script src="https://cdn.ckeditor.com/ckeditor5/39.0.1/classic/ckeditor.js"></script>

</head>

<body>

<h4 class="mb-3">
<i class="fa fa-plus-circle"></i> Insert Product
</h4>

<?php if(!empty($_SESSION['msg'])){ ?>
<div class="alert alert-success text-center">
    <?php echo $_SESSION['msg']; $_SESSION['msg']=""; ?>
</div>
<?php } ?>

<div class="col-md-6">
<label>Category</label>
<select name="category" class="form-select" onchange="getSubcat(this.value)" required>
<option value="">Select Category</option>
<?php
$q=$con->query("SELECT * FROM category");
while($c=$q->fetch_assoc()){
    echo "<option value='{$c['id']}'>{$c['categoryName']}</option>";
}
?>
</select>
</div>

<div class="col-md-6">
<label>Sub Category</label>
<select name="subcategory" id="subcategory" class="form-select" required></select>
</div>

<div class="col-md-6">
<label>Product Name</label>
<input type="text" name="productName" class="form-control" required>
</div>

<div class="col-md-6">
<label>Company</label>
<input type="text" name="productCompany" class="form-control" required>
</div>

<div class="col-md-6">
<label>Price Before Discount</label>
<input type="number" step="0.01" name="productpricebd" class="form-control" required>
</div>

<div class="col-md-6">
<label>Selling Price</label>
<input type="number" step="0.01" name="productprice" class="form-control" required>
</div>

<div class="col-md-12">
<label>Description</label>
<textarea name="productDescription" id="editor"></textarea>

</div>

<div class="col-md-6">
<label>Shipping Charge</label>
<input type="number" name="productShippingcharge" class="form-control" required>
</div>

<div class="col-md-6">
<label>Availability</label>
<select name="productAvailability" class="form-select" required>
<option value="">Select</option>
<option>In Stock</option>
<option>Out of Stock</option>
</select>
</div>

<div class="col-md-4">
<label>Image 1</label>
<input type="file" name="productimage1" class="form-control" required>
</div>

<div class="col-md-4">
<label>Image 2</label>
<input type="file" name="productimage2" class="form-control" required>
</div>

<div class="col-md-4">
<label>Image 3</label>
<input type="file" name="productimage3" class="form-control">
</div>

</div>

<hr>

<button type="submit" name="submit" class="btn btn-primary w-100">
<i class="fa fa-save"></i> Insert Product
</button>

</form>

</div>
</div>

Ukuran: 6.5 KB