Php 上载时重命名

我不熟悉php，但是。。。 我有一个表格和两个上传文件fild，一个用于arhive，另一个用于它的缩略图。 它将名称放入mysql表中。 首先，如果文件存在于dir中，那么将其重命名会很好，但我不能这样做。 第二，它上传图像，但我不能用特定的比例制作缩略图

我的表格：

<form method="post" action="up.php" enctype="multipart/form-data">
        <p>
          Firstname:
        </p>
        <input type="text" name="firstname"/>
         <p>
          lastname:
        </p>
        <input type="text" name="lastname"/>
        <p>
          Please Upload a Photo.
        </p>
        <p>
          Photo:
        </p>
        <input type="hidden" name="size" value="350000">
        <input type="file" name="photo"> 
        <p>
         Arhiv:
        </p>
        <input type="hidden" name="size" value="350000">
        <input type="file" name="sub"> 
        <p>
          middlename:
        </p>

名字：


姓氏：


请上传一张照片。


照片:


抗逆转录病毒：


中间名：

地址:

还有我的upload.php

    <?php

//This is the directory where images will be saved
$arhiv = "files/";
$arhiv = $arhiv . basename( $_FILES['sub']['name']);
$target = "upl/";
$target = $target . basename( $_FILES['photo']['name']);

//This gets all the other information from the form
$firstname=$_POST['firstname'];
$lastname=$_POST['lastname'];
$poster=($_FILES['photo']['name']);
$middlename=$_POST['middlename'];
$address=$_POST['address'];
$arhiv=($_FILES['sub']['name']);

// Connects to your Database
mysql_connect("localhost", "root", "pass") or die(mysql_error()) ;
mysql_select_db("asc_desc") or die(mysql_error()) ;

//Writes the information to the database
mysql_query("INSERT INTO member (firstname,lastname,poster,middlename,address,arhiv)
VALUES ('$firstname', '$lastname', '$poster', '$middlename', '$address', '$arhiv')") ;

//Writes the photo to the server
if(move_uploaded_file($_FILES['photo']['tmp_name'], $target));
if(move_uploaded_file($_FILES['sub']['tmp_name'], $arhiv))
{

//Tells you if its all ok
echo "The file ". basename( $_FILES['photo']['name']). " has been uploaded, and your information has been added to the directory";
echo "<p>The file ". basename( $_FILES['sub']['name']). " is uploaded, too";
}
else {

//Gives and error if its not
echo "Sorry, there was a problem uploading your file.";
}

?>
<p>
<a href="1.php">Back to form</a>

---

您的代码易受SQL注入攻击。你应该继续读下去。您还应该检查正在上载的文件，否则可能会上载恶意文件，如
.php
文件。是的，我知道，但首先我想让它正常工作，然后检查文件和大小