使用 AJAX 上传文件并传递额外数据：FormData 的正确用法

var form_data = new FormData();
var files = $('#multiple_files')[0].files;

// 检查文件数量
if(files.length > 15) {
    alert('You can not select more than 15 files');
    return;
}

// 添加文件到 FormData
for(var i = 0; i < files.length; i++) {
    form_data.append("files[]", files[i]); // 使用 files[] 允许上传多个文件
}

// 添加额外的参数
var id = "<?php echo $id ?>"; // 从 PHP 获取 ID
form_data.append("id", id);

// 发送 AJAX 请求
$.ajax({
    url: "upload.php",
    data: form_data,
    method: "POST",
    contentType: false,
    cache: false,
    processData: false,
    beforeSend: function() {
        $('#error_multiple_files').html('<br /><label class="text-primary">Uploading...</label>');
    },
    success: function(data) {
        $('#error_multiple_files').html('<br /><label class="text-success">Uploaded</label>');
        load_image_data();
    },
    error: function(xhr, status, error) {
        console.error("AJAX request failed:", status, error);
        $('#error_multiple_files').html('<br /><label class="text-danger">Upload Failed</label>');
    }
});

<?php

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $id = $_POST['id']; // 获取 ID

    // 检查是否有文件上传
    if (isset($_FILES['files'])) {
        $files = $_FILES['files'];
        $fileCount = count($files['name']);

        for ($i = 0; $i < $fileCount; $i++) {
            $file_name = $files['name'][$i];
            $file_tmp = $files['tmp_name'][$i];
            $file_error = $files['error'][$i];

            // 检查上传是否出错
            if ($file_error === UPLOAD_ERR_OK) {
                // 生成唯一的文件名
                $new_file_name = uniqid() . '_' . $file_name;
                $file_destination = 'uploads/' . $new_file_name;

                // 移动上传的文件
                if (move_uploaded_file($file_tmp, $file_destination)) {
                    // TODO:  使用预处理语句防止 SQL 注入
                    $query = "INSERT INTO tbl_image (postid, image_name, image_description) VALUES (?, ?, '')";
                    $stmt = $mysqli->prepare($query);
                    $stmt->bind_param("ss", $id, $new_file_name); // "ss" 表示两个字符串参数
                    $stmt->execute();
                    $stmt->close();

                    echo "File uploaded successfully: " . $file_name . "\n";
                } else {
                    echo "Failed to move uploaded file: " . $file_name . "\n";
                }
            } else {
                echo "Error uploading file: " . $file_name . " (Error code: " . $file_error . ")\n";
            }
        }
    } else {
        echo "No files uploaded.\n";
    }
} else {
    echo "Invalid request method.\n";
}

?>

<?php

// 假设你已经建立了数据库连接 $mysqli

// 准备 SQL 语句
$query = "INSERT INTO tbl_image (postid, image_name, image_description) VALUES (?, ?, '')";

// 创建预处理语句
$stmt = $mysqli->prepare($query);

// 检查预处理语句是否创建成功
if ($stmt === false) {
    die("Error preparing statement: " . $mysqli->error);
}

// 绑定参数
$stmt->bind_param("ss", $id, $new_file_name); // "ss" 表示两个字符串参数

// 执行查询
if ($stmt->execute()) {
    echo "Record inserted successfully.\n";
} else {
    echo "Error inserting record: " . $stmt->error . "\n";
}

// 关闭语句
$stmt->close();

?>