Data not being sent to database

Question

I am making an image uploading feature which stores the file name in the database and the photo in a folder called uploaded. These photos are being moved to the uploaded folder but for some reason I cannot save the file name in the database.

• I have also ensured I have connected to the db and have all my columns referenced correctly. I am receiving no errors, the data is just not being stored in the database.

  if(isset($_POST['pp_submit'])){
      session_start();
          $file = $_FILES['pp_file']['name'];
          $ppf_type = $_FILES['pp_file']['type'];
          $ppf_size = $_FILES['pp_file']['size'];
          $ppf_tmpname = $_FILES['pp_file']['tmp_name'];
          $ppf_err = $_FILES['pp_file']['error'];
      $var = $_SESSION['id'];
  
     if($ppf_err > 0){ header('Location: ../profile.php');}
  
      move_uploaded_file($ppf_tmpname,"../uploaded/".$file);
      mysql_query("INSERT INTO users (profile) VALUES ('$file') WHERE id = '$var'");
  
  
  if(mysql_affected_rows()>0){
  echo "Item added successfully.<br/>";}
  else
  { echo "Item addition failed.<br/>"; }
  header("Location: ../profile.php?id=$var");
  }
  

My question is: Why isn't the file name passed through the database?

• I am also curious as to why move_uploaded_file() is working but not the query directly below it.

Answer 1

That should be an update query instead of an insert query:

mysql_query("UPDATE users SET profile = '$file' WHERE id = '$var'");

Also note that:

• You're using a deprecated API. Consider switching to the mysqli_* functions or using PDO.
• You're wide open to SQL injection attacks. Consider using prepared statements.