Store files in MySQL database from HTML form

I've got the following HTML form. As you can see it's saving a file.

<form enctype="multipart/form-data" action="welcome.php" method="post
"onsubmit="return validateFormOnSubmit(this)"> 
 <b>Name</b><br/> <input type="text" name="fname" /> 
 <br/>
 <b>Description</b><br/> <TEXTAREA NAME="description" COLS=40
 ROWS=6></TEXTAREA><br/><br/> <input type="hidden" name="MAX_FILE_SIZE" value="100000"/> 

<b>Upload Picture</b><br/> <input name="uploadedfile" type="file" /><br /> 
 <b>Latitude</b><br/><INPUT name="lat" id ="lat" /><br/> 
 <b>Longitude</b><br/><INPUT     name="lng" id ="lng" /><br/> <input type="submit" />

This file is being processed like so...

 $target_path = "uploads/";

 $target_path = $target_path . basename( $_FILES['uploadedfile']['name']);

The rest of the information is being stored in a SQL database. I'd like to store the file uploaded in that database. How would I go about doing this via the php file the information get's sent to? I'm inserting it like..

   $query = "INSERT INTO <TABLE> (name, message, lat, lng, type)VALUES ('".$title."', '".$des."', '".$lati."', '".$long."', '".$type."')";
   $q=mysql_query($query) or die(mysq开发者_运维百科l_error());

If you definitely want to insert your HTML file in your MySQL DB, there are two ways:

1. Use the BLOB type to store the file.

2. Convert your file into a string, as it is HTML, and store it in a TEXT field.

However, my recommendation would be to store files on the server filesystem, and not in the database.

You can do this in tow ways.

1. Copying the file into filesystem and saving its path in database

2. Storing the file as binary data in database.

   $data = file_get_contents($_FILES['photo']['tmp_name']);
   $data = mysql_real_escape_string($data);
   

and then save data in a field (you need to create that field as blob)

You mean the contents of the uploaded file?

Pretty much like below:

// Obtain the file content (add error handling here...)
$contents = file_get_contents($_FILES['uploadedfile']['tmp_name']);
// Escape all special characters
$contents = mysql_real_escape_string($contents)
// Do the insert
$query = 'INSERT INTO <TABLE> (....) VALUES ("' . $contents . '")';
$q=mysql_query($query) or die(mysql_error());

Edit: marvin is right, its file_get_contents.