How to correctly use PHP preprocessing statements to update multi-image product pages (including file upload and old image cleaning)

This article explains in detail how to use PDO/MySQLi preprocessing statements to safely update product data containing 5 pictures, focusing on solving common problems such as old pictures not being correctly retained when updating multiple pictures, `unlink()` calling errors, variable scope confusion, and misaligned SQL binding parameters.

When developing a product management backend, it is a common requirement to support multiple image uploads (such as the main image and 4 detailed images). However, many developers tend to fall into a typical misunderstanding when implementing the "edit update" function: writing all image logic in an if-else branch, resulting in only the last image having rollback logic, and the remaining images will be left blank or cause unlink() errors once they are not uploaded . This is the fundamental reason why $newimage2 to $newimage4 lack independent else branches in the original code.

✅ Correct approach: handle the upload logic independently for each picture

Each image (image, image2, ..., image5) should have a completely independent process of judgment, deletion, uploading and default value assignment . The following is the core update logic after repair (adapted to MySQLi):

 // Initialize new path variables (to avoid undefined warnings)
$newimage = $oldimage;
$newimage2 = $oldimage2;
$newimage3 = $oldimage3;
$newimage4 = $oldimage4;
$newimage5 = $oldimage5;

// Image 1 processing if (!empty($_FILES['image']['name'])) {
    $newimage = 'uploads/' . basename($_FILES['image']['name']);
    if (file_exists($oldimage)) unlink($oldimage);
    move_uploaded_file($_FILES['image']['tmp_name'], $newimage);
}

// Image 2 processing if (!empty($_FILES['image2']['name'])) {
    $newimage2 = 'uploads/' . basename($_FILES['image2']['name']);
    if (file_exists($oldimage2)) unlink($oldimage2);
    move_uploaded_file($_FILES['image2']['tmp_name'], $newimage2);
}

// Image 3 processing (note: $_FILES['image']['tmp_name'] was misused here in the original code, which has been corrected)
if (!empty($_FILES['image3']['name'])) {
    $newimage3 = 'uploads/' . basename($_FILES['image3']['name']);
    if (file_exists($oldimage3)) unlink($oldimage3);
    move_uploaded_file($_FILES['image3']['tmp_name'], $newimage3); // ✅ Corrected to image3
}

// Image 4 processing if (!empty($_FILES['image4']['name'])) {
    $newimage4 = 'uploads/' . basename($_FILES['image4']['name']);
    if (file_exists($oldimage4)) unlink($oldimage4);
    move_uploaded_file($_FILES['image4']['tmp_name'], $newimage4);
}

// Image 5 processing (the original code unlink($oldimage) is wrong, it should be $oldimage5)
if (!empty($_FILES['image5']['name'])) {
    $newimage5 = 'uploads/' . basename($_FILES['image5']['name']);
    if (file_exists($oldimage5)) unlink($oldimage5); // ✅ Corrected to $oldimage5
    move_uploaded_file($_FILES['image5']['tmp_name'], $newimage5);
}

⚠️Key Notes

• $_FILES index consistency : Ensure that each $_FILES['imageX']['name'] corresponds to $_FILES['imageX']['tmp_name']. The tmp_name of image3 in the original code is written as $_FILES['image']['tmp_name'], which will cause the upload to fail.
• Always check whether the file exists before unlink() : use file_exists($path) to avoid warnings caused by empty paths or deleted files.
• SQL parameter binding must strictly correspond : the order of placeholders and the order of variables in bind_param() in the update statement must be exactly the same:

   $sql = "UPDATE vehicle SET 
      title=?, make=?, model=?, price=?, loc=?, yr=?, 
      condis=?, trans=?, mileage=?, isfeatured=?, wheel=?, details=?, 
      photo=?, photo2=?, photo3=?, photo4=?, photo5=? 
      WHERE id=?";
  $stmt->bind_param(
      "sssssisssissssssi", 
      $title, $make, $model, $price, $loc, $yr,
      $condi, $trans, $mileage, $isfeatured, $wheel, $details,
      $newimage, $newimage2, $newimage3, $newimage4, $newimage5, $id
  );

• The HTML form must contain hidden fields to pass the original image path : ensure that fields such as exist and have correct values ​​(it is recommended to use htmlspecialchars() to prevent XSS).
• Security enhancement suggestions :
  • Use pathinfo() to verify file extensions and reject non-image types;
  • Generate unique file names (such as uniqid() . '.' . $ext) to avoid overwriting and conflicts;
  • Set the upload directory to non-Web executable (for example, disable .php parsing in the uploads/ directory).

✅ Summary

The essence of multi-image update is "atomic operation": the life cycle of each image (old image deletion → new image upload → path saving) must be isolated from each other and not interfere with each other. Abandon the lazy writing method of "unifying else branches" and insist on writing independent conditional blocks for each $_FILES field. Coupled with rigorous preprocessing parameter binding, you can stably support any number of image field updates. Remember: Robust file handling = explicit initialization independent judgment safe cleanup strict binding .

The above is the detailed content of How to correctly use PHP preprocessing statements to update multi-image product pages (including file upload and old image cleaning). For more information, please follow other related articles on the PHP Chinese website!