GabHelpmePlease2019

<?php
 session_start();
 if($_SESSION['login'] != "OK")
 {
 header('Location: index.php');
 exit();
 }
?>


<?php require("db.php"); $id =$_REQUEST['BookID'];
 $result = mysql_query("SELECT * FROM books WHERE BookID  = '$id'"); $test = mysql_fetch_array($result); if (!$result)
        {
        die("Error: Data not found..");
        }
                $Title=$test['Title'] ;
                $Author= $test['Author'] ;
                $PublisherName=$test['PublisherName'] ;
                $CopyrightYear=$test['CopyrightYear'] ;
                $ISBN=$test['ISBN'] ;

    if(isset($_POST['save'])){


    $file = $_FILES['file'];
    //var_dump ($fileName);
    //die();


    $fileName = $_FILES['file']['name'];
    $fileTmpName = $_FILES['file']['tmp_name'];
    $fileSize = $_FILES['file']['size'];
    $fileError = $_FILES['file']['error'];
    $fileType = $_FILES['file']['type'];


    $fileExt = explode('.', $fileName);
    $fileActualExt = strtolower(end($fileExt));

    $allowed = array('jpg', 'jpeg', 'png', 'pdf');


    if(in_array($fileActualExt, $allowed)){

        if($fileError === 0){
            if ($fileSize < 1000000){
                $fileNameNew = uniqid('',true).".".$fileActualExt;              //sets a unique indentifier related to real time so each file has a unique ID
                $fileDestination = 'uploads/'.$fileNameNew;
                move_uploaded_file($fileTmpName,$fileDestination);


            }else {
                echo " file too large!";
            }

        }else{
            echo " error uploading file!";
        }


    }else{
        echo " you cannot upload files of this type!";
    }


    $title_save = $_POST['title'];
    $author_save = $_POST['author'];
    $name_save = $_POST['name'];
    $copy_save = $_POST['copy'];
    $isbn_save = $_POST['isbn'];
    $cover = $fileDestination;

    mysql_query("UPDATE books SET Title ='$title_save', Author ='$author_save',
         PublisherName ='$name_save',CopyrightYear ='$copy_save',ISBN ='$isbn_save', cover = '$cover' WHERE BookID = '$id'")
                or die(mysql_error());
    echo "Saved!";

    header("Location: protected.php");
}

//mysql_close($conn);
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Untitled Document</title>
</head>

<body>
<form action="view.php" method="post">
<table>
    <tr>
        <td>Title:</td>