Upload PHP Script Validation

Hi All,

I'm using the script at the bottom of this post to upload a file and store data in a database.

I am trying to validate it as it should be more secure by the looks of things.

I'm used spry validation on the form on the previous page, however, I know this does not stop injection - is that right?

I've tried using this code and have wrapped it around but it doesn't work properly and if all details are correct it doesn't post the data or the file.

<?php

$error = array();

          //Check length of Book title

          $_POST['name'] = trim($_POST['name']);

          if (strlen($_POST['name']) < 1) {

                    $error['nameEmpty'] = 'Please insert a title for your Book';

          }

          $_POST['publication'] = trim($_POST['publication']);

          if (strlen($_POST['publication']) < 1) {

                    $error['publicationEmpty'] = 'You must enter a publication';

          }

          $_POST['year'] = trim($_POST['year']);

          if (strlen($_POST['year']) != 4) {

                    $error['yearLength'] = 'Years can only have 4 digits';

          }

          $_POST['description'] = trim($_POST['description']);

          if (strlen($_POST['description']) < 1) {

                    $error['descriptionLength'] = 'Please enter a description';

          }

          $_POST['description'] = trim($_POST['description']);

          if (strlen($_POST['description']) > 500) {

                    $error['descriptionLength2'] = 'The description can only have up to 500 characters';

          }

          $_POST['linkToBuy'] = trim($_POST['linkToBuy']);

          if (strlen($_POST['linkToBuy']) < 6) {

                    $error['linkToBuyLength'] = 'Please make sure the format is as follows - www.example.co.uk';

          }

          $_POST['price'] = trim($_POST['price']);

          if (strlen($_POST['price']) < 2) {

                    $error['priceLength'] = 'The price must be more than 1 Character long and contain a pound sign';

          }

          if (!error) {

UPLOAD CODE

}

?>

Upload Code:

<?php

//this is the directory where the images images will be saved

$target = "../IMAGES/books/";

$target = $target . basename( $_FILES['imageURL']['name']);

// this gets all the other info from the form

$name=$_POST['name'];

$publication=$_POST['publication'];

$year=$_POST['year'];

$desc=$_POST['description'];

$link=$_POST['linkToBuy'];

$price=$_POST['price'];

$pic=($_FILES['imageURL']['name']);

// Connects to your Database

mysql_connect("host", "username", "password") or die(mysql_error()) ;

mysql_select_db("Database Name") or die(mysql_error()) ;

//Writes the information to the database

mysql_query("INSERT INTO tableName (name,publication,year,description,linkToBuy,price,imageURL)

VALUES ('$name', '$publication', '$year', '$desc', '$link', '$price', '$pic')") ;

//Writes the photo to the server

if(move_uploaded_file($_FILES['imageURL']['tmp_name'], $target))

{

          $note['success'] = 'The file '. basename( $_FILES['imageURL']['name']). ' has been uploaded, and your information has been added to the directory';

}

else {

          //Give an error if it's not

          $note['error'] = 'Sorry, there was a problem uploading your file.';

}

?>