使用 AJAX 上传文件时传递额外数据的方法

  var id = "<?php echo $id ?>"; // 从 PHP 获取 ID

  var form_data = new FormData();
  var files = $('#multiple_files')[0].files;

  // 添加文件
  for(var i = 0; i < files.length; i++){
    form_data.append("files[]", files[i]); // 允许上传多个文件
  }

  // 添加 ID
  form_data.append("id", id);

  $.ajax({
    url: "upload.php",
    data: form_data,
    method: "POST",
    contentType: false,
    cache: false,
    processData: false,
    beforeSend: function() {
      $('#error_multiple_files').html('<br /><label class="text-primary">Uploading...</label>');
    },
    success: function(data) {
      $('#error_multiple_files').html('<br /><label class="text-success">Uploaded</label>');
      load_image_data();
    },
    error: function(xhr, status, error) {
        console.error("AJAX request failed:", status, error);
        $('#error_multiple_files').html('<br /><label class="text-danger">Upload Failed: ' + error + '</label>');
    }
  });

// 错误示例
$.ajax({
  url: "upload.php",
  data: { id : id, form_data: form_data }, // 错误: 不应该将 FormData 嵌套在对象中
  method: "POST",
  contentType: false,
  cache: false,
  processData: false,
  // ...
});

<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $id = $_POST['id'];

    // 处理上传的文件
    if (isset($_FILES['files'])) {
        $files = $_FILES['files'];
        $file_count = count($files['name']);

        for ($i = 0; $i < $file_count; $i++) {
            $file_name = $files['name'][$i];
            $file_tmp = $files['tmp_name'][$i];
            $file_error = $files['error'][$i];

            if ($file_error === UPLOAD_ERR_OK) {
                $upload_dir = "uploads/"; // 存储上传文件的目录
                $upload_path = $upload_dir . basename($file_name);

                if (move_uploaded_file($file_tmp, $upload_path)) {
                    // 文件上传成功，执行数据库操作
                    // *** 重要：使用参数化查询防止 SQL 注入 ***
                    $servername = "localhost";
                    $username = "username";
                    $password = "password";
                    $dbname = "database_name";

                    $conn = new mysqli($servername, $username, $password, $dbname);

                    if ($conn->connect_error) {
                        die("Connection failed: " . $conn->connect_error);
                    }

                    $sql = "INSERT INTO tbl_image (postid, image_name, image_description) VALUES (?, ?, '')";
                    $stmt = $conn->prepare($sql);
                    $stmt->bind_param("ss", $id, $file_name); // "ss" 表示两个字符串参数

                    if ($stmt->execute() === TRUE) {
                        echo "File uploaded and database record created successfully for " . $file_name . "<br>";
                    } else {
                        echo "Error: " . $sql . "<br>" . $conn->error;
                    }

                    $stmt->close();
                    $conn->close();

                } else {
                    echo "Error moving uploaded file " . $file_name . "<br>";
                }
            } else {
                echo "Error uploading file " . $file_name . ": " . $file_error . "<br>";
            }
        }
    } else {
        echo "No files uploaded.<br>";
    }
} else {
    echo "Invalid request method.<br>";
}
?>