<?php
require_once $_SERVER['DOCUMENT_ROOT'] . '/ad/app_connect.php';
require_once $_SERVER['DOCUMENT_ROOT'] . '/ad/fun.php';
if (empty($_POST)){
echo 'Что то не так с формой!';
exit;
}
/** $path Определяем путь к загружаемым картинкам
* $dir Проверка есть ли папка с датой Если нет, то создаем
*/
$path = $_SERVER['DOCUMENT_ROOT'] . '/images/kv/';
$dir = $path . date('m-Y') . '/';
if (!is_dir($dir)){
mkdir($dir);
}
/**
* Загружаем картинку
*/
if ($_FILES['photo']['error'] == 0){
if($_FILES['photo']['type'] == "image/gif" || $_FILES['photo']['type'] == "image/png" ||
$_FILES['photo']['type'] == "image/jpg" || $_FILES['photo']['type'] == "image/jpeg"){
$blacklist = array(".php", ".phtml", ".php3", ".php4");
foreach ($blacklist as $item){
if(preg_match("/$item\$/i", $_FILES['photo']['name'])){
echo 'Нельзя загружать скрипты!';
exit;
}
}
$tmp_name = $_FILES['photo']["tmp_name"];
$image = date('dmY-His_') . $_FILES['photo']['name'];
move_uploaded_file($tmp_name, $dir . $image);
}else{
echo 'Только gif, png, jpg, jpeg';
exit;
}
}else{
echo 'Ошибка при загрузке!';
exit;
}
/**
* функция add_String_To_Db() безопасное добавление в БД
*/
$address = (string)(add_String_To_Db($_POST['address']));
$object = (int)(add_String_To_Db($_POST['object']));
$floor = (int)(add_String_To_Db($_POST['floor']));
$type_of_house = (string)(add_String_To_Db($_POST['type_of_house']));
$total_area = (int)(add_String_To_Db($_POST['total_area']));
$area_of_rooms = (string)(add_String_To_Db($_POST['area_of_rooms']));
$living_area = (int)(add_String_To_Db($_POST['living_area']));
$kitchen_area = (int)(add_String_To_Db($_POST['kitchen_area']));
$bathroom = (string)(add_String_To_Db($_POST['bathroom']));
$balcony = (string)(add_String_To_Db($_POST['balcony']));
$elevator = (string)(add_String_To_Db($_POST['elevator']));
$prise = (int)(add_String_To_Db($_POST['prise']));
$comment = (string)(add_String_To_Db($_POST['comment']));
/**
* Отправляем в БД
*/
$query = "INSERT INTO `object` (`address`, `object`, `prise`, `floor`, `type_of_house`, `total_area`, `area_of_rooms`, `living_area`, `kitchen_area`, `bathroom`, `balcony`, `elevator`, `comment`, `images`)
VALUES ('{$address}', '{$object}', '{$floor}', '{$type_of_house}', '{$total_area}', '{$area_of_rooms}', '{$living_area}', '{$kitchen_area}', '{$bathroom}', '{$balcony}', '{$elevator}', '{$prise}', '{$comment}', '{$image}')";
$result = mysqli_query($connect, $query) or die ('Ошибка:' . mysqli_error($connect));
confirm_query($result);