sql problem

AlexandruDan

i try to add some entries into a data base and i don't understand why it doesn't work:

the code is:
<?php
include ("../../db.php");
$q=mysql_query("SELECT * FROM `categorii`");
echo '<SELECT NAME="cat_parinte">';
echo '<OPTION VALUE = "0" SELECTED = "SELECTED">Principal </OPTION>';

WHILE ($date=mysql_fetch_array($q)){
echo "<OPTION VALUE =\"".$date[0]."\">".$date["cat_nume"]."</OPTION>";
}
echo "</SELECT>";
?>
<form method = "post" action = "procesare.php" ENCTYPE = "MULTIPART/FORM-DATA">
nume: <input type = "text" name = "pr_nume"><br />
descriere: <textarea name = "desc" rows = "5" cols = "20"></textarea><br />
pret: <input type = "text" name = "pr_pret"><br />
cantitate: <input type = "text" name = "pr_cantitate"><br />
poza: <input type = "file" name = "poza"><br />
trimite <input type = "submit" value = "trimite">
</ form>

and the procesare.php is:

<?php
include ("../../db.php");
$nume_categorie = $_POST["cat_nume"];
$nume_produs = $_POST["pr_nume"];
$desc = $_POST["desc"];
$pret = $_POST["pr_pret"];
$cantitate = $_POST["pr_cantitate"];
if ($_FILES["poza"]["name"]){
$nume = explode (".",$_FILES["poza"]["name"]);
$nr = count($nume);
$nr-=1;
$ext = $nume[$nr];
$nume = md5(time());
$ext_permise = array("jpg","png","gif");
if (in_array ($ext,$ext_permise)){
$src = $_FILES["poza"]["tmp_name"];
$nume_final = $nume.".".$ext;
$dest = "../../poze/produse/".$nume_final;
// echo $dest;

move_uploaded_file ($src,$dest);
}

}

$sql = "INSERT INTO `produse` (`cat_id`,`pr_nume`,`pr_descriere`, `pr_pret`, `pr_cantitate`,`pr_poza`, ) VALUES ('$nume_categorie','$nume_produs',
'$desc', '$pret', '$cantitate', '$nume_final')";
$q=mysql_query($sql);
if($q){
echo "Am adaugat categoria";

}
/*echo $sql; returns INSERT INTO `produse` (`cat_id`,`pr_nume`,`pr_descriere`, `pr_pret`, `pr_cantitate`,`pr_poza`, ) VALUES ('','de', '123', '1234', '12', 'cd6ed986562aebf6333951973dfa478f.jpg') */
?>

kv

Can you post some details like what you are trying to do, what do you mean when you say it doesn't work -- is it giving error or is not behaving as expected, etc?

Aredon

Edit $sql and remove the extra comma lest it generate a MySQL query syntax error. Simple fix, eh? It happens.
Before:

AlexandruDan

Thank you Aredon, it worked.
I will use the tip you gave me about mysql_real_escape_string