PHP - Php Csv Import Script Error

I've written the script below to import a csv file into the database. I've tried to make this as secure as possible by sanitizing and validating the data, but is there anything else I could do to improve it? I'm happy with the way it works so far.   All I can think to add is a meme check via php but I can't find a way to check whether it's specifically a csv file (other than just checking the extension but that's not secure)

<?php

if ($_FILES[csv][size] > 0) {
 
    //get the csv file
    $file = $_FILES[csv][tmp_name];
    $handle = fopen($file,"r");
 
    //set the row counter
    $csv_row = 0;
 
    //loop through the csv file and insert into database
    do {
 
        // start the import
        if ($data[0]) {
 
          //add 1 the row counter
          $csv_row++;
         
          //clear errors
          $errors = '';
         
          //sanitize the inputs
          $firstName = addslashes($data[0]);
          $lastName = addslashes($data[1]);
          $email = addslashes($data[2]);

         
 
          //validate the inputs - set $errors as 'YES' if any fail
          if(!ctype_alpha($firstName)){
          $errors = 'YES';    
          }
          if(!ctype_alpha($lastName)){
          $errors = 'YES';
          }
          if(!filter_var($email, FILTER_VALIDATE_EMAIL)){
          $errors = 'YES';
          }
 
          //check whether there were any errors in the validation
          if($errors!=='YES'){
              //insert into database
              $stmt = $db->prepare("INSERT INTO test (firstName,lastName,email) VALUES (?,?,?)");
              $stmt->bind_param('sss',$firstName,$lastName,$email);
              $stmt->execute();
          }
          //there was an error, store the affected row number in the error array
          else
          {
          $error_report[] = "There was an error on row $csv_row";
          } //end error check
 
 
 
       } //end single row import
 
    } while ($data = fgetcsv($handle));

    if($csv_row>0){
    	$success = 'YES';
    }
      
 } // end csv import
?>

Edited by paddyfields, 11 June 2014 - 01:06 PM.

I am looking for a way to upload a csv file to a website and have it populate a database.  Does anyone know of a way to do this.  The users of the site are novice website users and I am a novice php coder.

Any help would be hugely appreciated.

Thanks

help - can you tell me why this is giving the following error   #1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'DROP TABLE IF EXISTS `admin`' at line 8   i am trying to import a data file ... first few lines of which are   -- MySQL dump 10.10
--
-- Host: localhost    Database: bromleyone
-- ------------------------------------------------------
-- Server version    5.0.22-Debian_0ubuntu6.06.10-log

/*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
/*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
/*!40101 SET NAMES utf8 */;
/*!40103 SET @OLD_TIME_ZONE=@@TIME_ZONE */;
/*!40103 SET TIME_ZONE='+00:00' */;
/*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;
/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;
/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;
/*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;

use bromleyone


--
-- Table structure for table `admin`
--

DROP TABLE IF EXISTS `admin`;
CREATE TABLE `admin` (
  `id` int(11) NOT NULL auto_increment,
  `username` varchar(30) NOT NULL default '',
  `password` varchar(30) NOT NULL default '',
  `name` varchar(40) NOT NULL default '',
  PRIMARY KEY  (`id`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;
 

Hi!
I hope somebody can help me what im do wrong.
i have checked that the data from the file is in $source_file but nothing imports to the database

Code: [Select]
<?php

include('config.php');
include('opendb.php');

if(isset($_POST['upload']))
{
$source_file = @$_POST['userfile'];

//$source_file = fopen('http://localhost/test/upload/test.csv', 'r');
$target_table = 'foretag';
function csv_file_to_mysql_table($source_file, $target_table, $max_line_length=10000) {
     if (($handle = fopen("$source_file", "r")) !== FALSE) { 
        $columns = fgetcsv($handle, $max_line_length, ","); 
        foreach ($columns as $column) { 
            $column = str_replace(".","",$column); 
        } 
        $insert_query_prefix = "INSERT INTO $target_table (".join(",",$columns).")\nVALUES";
         while (($data = fgetcsv($handle, $max_line_length, ";")) !== FALSE) { 
            while (count($data)<count($columns)) 
                array_push($data, NULL); 
            $query = "$insert_query_prefix (".join(",",quote_all_array($data)).");";
             mysql_query($query); 
        } 
        fclose($handle); 
    } 
} 

function quote_all_array($values) { 
    foreach ($values as $key=>$value) 
        if (is_array($value)) 
            $values[$key] = quote_all_array($value); 
        else 
            $values[$key] = quote_all($value); 
    return $values; 
} 

function quote_all($value) { 
    if (is_null($value)) 
        return "NULL"; 

    $value = "'" . mysql_real_escape_string($value) . "'"; 
    return $value; 
}
}
include('closedb.php');

echo "<br>done<br>";

?>

what am i doing wrong?
 
Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in /****/*****/*/domains/klikertje.nl/public_html/adminpaneel/index.php on line 123
script of adminpaneel/index.php


<?php
include("../config.php");
include('../cronjobs.php');
$gebruikersnaam = "robin"; //De gewenste gebruikernaam
$wachtwoord     = "rg953gejFDI3c"; //Het gewenste wachtwoord
if(preg_match('/^[a-zA-Z ]+$/D', $_SERVER['PHP_AUTH_USER']) == 0){
if(preg_match('/^[a-zA-Z ]+$/D', $_SERVER['PHP_AUTH_PW']) == 0){
if($_SERVER['PHP_AUTH_USER'] != $gebruikersnaam || $_SERVER['PHP_AUTH_PW'] != $wachtwoord)
{
  header("WWW-Authenticate: Basic realm=\"Beveiliging\"");
  header("HTTP/1.0 401 Unauthorized");
  echo "Je bent niet ingelogd! Probeer het <A HREF=\"javascript:location.reload();\">opnieuw</A>.";
  exit;
}
?>


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
 <head>
   <title>MiljoenenMail</title>
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />

    <meta name="keywords" content="miljoenenmail" />
    <meta name="description" content="MiljoenenMail" />
    <meta http-equiv="content-language" content="nl" />

    <link href="../css/style.css" rel="stylesheet" type="text/css" />


</head>
<body>
<div id="containermain">
<div id="headercontainer">
<div id="headerleft">
        <div id="logo"><img src="../images/miljoenenmaillogo.png"></div>
<div id="menu">
<ul>
<li class="first"><a href="index.php">Algemeen</a></li>
<li><a href="afmelden.php">Uitloggen</a></li>
<li><a href="profile.php">profiel</a></li>
<li><a href="payout.php">Uitbetaling</a></li>
</ul>
</div>


</div>
<div id="headerright">

<center><i>Welkom Beheerder</i></center>

<table border="0" width="235px" style="margin-top: 5px;" height="85px">
<tr><td><img src="images/parel.png" alt="Parel" /></td><td style="text-align:left;">Parels: <?=$gebruiker->parels?></td><td><img src="images/eurosymbol.png" alt="Euro"  /></td><td style="text-align:left;"><?=$gebruiker->saldo?></td></tr>
<tr><td><img src="images/klikmissie.png" alt="Kliknissie" /></td><td style="text-align:left;">Klikmissie</td><td><img src="images/wallet.png" alt="Uitbetalen"/></td><td style="text-align:left;">Uitbetalen</td></tr>
<tr><td><img src="images/message.png" alt="Berichten" /></td><td style="text-align:left;">Berichten: <b><?=$gebruiker->berichten?></b></td><td><img src="images/nl_flag.png" alt="" /></td><td style="text-align:left;">Nederland</td></tr>
2 </table>

        </div>
</div>

<div id="floatheader"></div>
<div id="tab_understroke"></div>

<div id="container">
<div id="rechtscontainer">
<div id="topblue"></div>

<div id="main">
<p><strong><h2>AdminPaneel</h2></strong></p>
<hr />
<form name="form1" method="post" action="">
  <table  border="0">
    <tr>
      <td>de nieuws/voorpagina wijzigen:</td>
      <?php if(!isset($_POST['Submit'])) { ?>
      <td><input name="nieuws" type="text" size="20" <?php if(isset($nieuws->inhoud)) { ?>value="<?=$nieuws->inhoud?>"<?php } ?>></td>
    </tr>
    <tr>
      <td colspan="2">
      <input type="submit" name="Submit" value="Opslaan">
      </td>
    </tr>
  </table>
</form>
<?php } else {
        if(isset($_POST['nieuws'])     OR $_POST['nieuws']     !== $nieuws->inhoud ) {        mysql_query("UPDATE cmssysteem SET inhoud='".$_POST['nieuws']."'"); }
        echo "bedankt voor je wijzigingen ze zijn succesvol opgeslagen en veel plezier verder met de site admin ;)";
}
?>
</div>

<div id="right">
<div class="title">Statistieken</div>
<div class="right_content">
Aantal leden: <?=$leden?><br />
Leden online: <?=$leden?><br />
Totaal aantal parels: <?=$totaalparels?><br />
&euro; 532,00 uitgekeerd!
</div>

</div>
</div>


<div id="float"></div>

<div id="footer"></div>

</div>
</div>
  <center><table border="0" width="861px">
        <tr><td align="left"><pre>&copy; 2010 Miljoenenmail.nl</pre></td><td align="right"><pre>made by: Ismail Metaich</pre></td></tr>
        </table></center>



</body>
</html>
<?
}
else
{
echo "<html><body>$_SERVER['PHP_AUTH_PW'] bevat cijfers of speciale tekens alleen letters mogelijk!</html></body>"
}

}
else
{
 echo "$_SERVER['PHP_AUTH_USER'] bevat cijfers of speciale tekens alleen letters mogelijk!";
}
?>