PHP+MySQL更新数据时如何删除文件夹中的旧图片？

我在使用PHP+MySQL进行产品数据更新时遇到问题：执行更新操作后，新图片可正常上传至指定文件夹，但旧图片无法从文件夹中删除。感觉代码逻辑存在缺失，但不清楚具体问题所在。

数据库更新查询代码 #

<?php
include 'dpconnection.php';

$uid = $_REQUEST['upid'];
if (isset($_POST['update'])) {
    $category = $_POST['category'];
    $pname = $_POST['pname'];
    $parea = $_POST['parea'];
    $pPrices = $_POST['pPrices'];
    $pAddress = $_POST['pAddress'];

    $filename = $_FILES['new_image']['name'];
    $tempname = $_FILES['new_image']['tmp_name'];
    $filesize = $_FILES['new_image']['size'];
    $fileextension = explode('.', $filename);
    $fileextension = strtolower(end($fileextension));

    $newfilename = uniqid() . 'images' . '.' . $fileextension;
    $path = "media/" . $newfilename;
    $sql = mysqli_query($conn, "UPDATE product SET c_id='$category', p_name='$pname', p_area='$parea', p_prices='$pPrices',p_address='$pAddress', p_thumb_image='$path' WHERE p_id='$uid'");

    if (move_uploaded_file($tempname, $path) && $sql) {
        echo "<script>alert('Record Updated successfully');</script>";
        echo "<script>location.href = 'adminViewProduct.php';</script>";
    } else {
        echo "Error updating record: " . $conn->error;
    }
}
?>

表单代码 #

<div class="form-group">
<label>Address</label>
<input class="form-control" type="text" name="pAddress" value="<?php echo $row1['p_address'];?>">
</div>

<div class="form-group">
<label>Thumb Image</label>
<input type="file" name="new_image" class="form-control">
<input  class="form-control" type="hidden" name="pimage" value="<?php echo $row1['p_thumb_image'];?>">
                        
<img class="float-left" src="<?php echo $row1['p_thumb_image'];?>" width="100px;"><br><br>
</div>

<div class="form-group text-center">
<input class="btn btn-primary" type="submit" name="update" value="Update">
</div>
</form>

问题分析与修复方案 #

核心问题 #

代码完全没有处理旧图片删除的逻辑：既没有获取表单传递的旧图片路径，也没有调用PHP的unlink()函数删除文件。此外还存在SQL注入风险，且未判断用户是否上传了新图片。

修复后的完整代码 #

<?php
include 'dpconnection.php';

$uid = $_REQUEST['upid'];
if (isset($_POST['update'])) {
    // 获取表单提交的旧图片路径
    $oldImagePath = $_POST['pimage'];
    $category = $_POST['category'];
    $pname = $_POST['pname'];
    $parea = $_POST['parea'];
    $pPrices = $_POST['pPrices'];
    $pAddress = $_POST['pAddress'];

    // 初始化图片路径为旧路径，默认不更新图片
    $imagePath = $oldImagePath;
    $isImageUpdated = false;

    // 判断用户是否上传了新图片
    if (!empty($_FILES['new_image']['name'])) {
        $filename = $_FILES['new_image']['name'];
        $tempname = $_FILES['new_image']['tmp_name'];
        $fileextension = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
        
        // 生成唯一文件名
        $newfilename = uniqid() . '_images.' . $fileextension;
        $imagePath = "media/" . $newfilename;
        $isImageUpdated = true;
    }

    // 使用预处理语句防止SQL注入
    $stmt = $conn->prepare("UPDATE product SET c_id=?, p_name=?, p_area=?, p_prices=?, p_address=?, p_thumb_image=? WHERE p_id=?");
    $stmt->bind_param("ssssssi", $category, $pname, $parea, $pPrices, $pAddress, $imagePath, $uid);

    if ($stmt->execute()) {
        // 如果更新了图片，先确认新图上传成功，再删除旧图
        if ($isImageUpdated && move_uploaded_file($tempname, $imagePath)) {
            // 检查旧文件存在再删除，避免报错
            if (file_exists($oldImagePath)) {
                unlink($oldImagePath);
            }
            echo "<script>alert('记录和图片更新成功');</script>";
        } else {
            echo "<script>alert('记录更新成功');</script>";
        }
        echo "<script>location.href = 'adminViewProduct.php';</script>";
    } else {
        echo "更新失败: " . $stmt->error;
    }

    $stmt->close();
    $conn->close();
}
?>

关键修复点 #

• 获取表单隐藏字段传递的旧图片路径$oldImagePath
• 判断用户是否上传新图片，避免无新图时覆盖图片路径
• 使用预处理语句prepare()和bind_param()防止SQL注入
• 新图上传且数据库更新成功后，用unlink()删除旧图片，删除前先判断文件存在
• 拆分逻辑，分别处理记录更新和图片更新的成功/失败情况

内容的提问来源于stack exchange，提问作者saddam hussain