if(isset($_POST['edit'])){
$uploaddir = 'files/';
$apend=date('YmdHis').rand(100,1000).'.jpg';
$uploadfile = "$uploaddir$apend";
if(($_FILES['file']['type'] == 'image/gif' || $_FILES['file']['type'] == 'image/jpeg' || $_FILES['file']['type'] == 'image/png')
&& ($_FILES['file']['size'] != 0 and $_FILES['file']['size']<=512000))
{
if (move_uploaded_file($_FILES['file']['tmp_name'], $uploadfile))
{
$size = getimagesize($uploadfile);
$query = "UPDATE `table1` SET `photo`= '$uploadfile',`Price` = '".$_POST['Price']."', `Model` = '".$_POST['Model']."' WHERE `ID` = ".(int)$edit_id;
$result=mysql_query($query) or die("Error:".mysql_error());
}
}
}
if (isset($_POST['edit'])) {
$uploaddir = 'files/';
$apend = date('YmdHis').rand(100,1000).'.jpg';
$uploadfile = "$uploaddir$apend";
$query_fields = [];
if (($_FILES['file']['type'] == 'image/gif' || $_FILES['file']['type'] == 'image/jpeg' || $_FILES['file']['type'] == 'image/png')
&& ($_FILES['file']['size'] != 0 and $_FILES['file']['size']<=512000))
{
if (move_uploaded_file($_FILES['file']['tmp_name'], $uploadfile))
{
$size = getimagesize($uploadfile);
$query_fields[] = "`photo`= '$uploadfile'";
}
}
$query_fields[] = "`Price` = '".$_POST['Price']."'";
$query_fields[] = "`Model` = '".$_POST['Model']."'";
$query = "UPDATE `table1` SET " . join(',', $query_fields) . " WHERE `ID` = ".(int)$edit_id;
$result=mysql_query($query) or die("Error:".mysql_error());
}
$query = "UPDATE `table1` SET `photo`= '$uploadfile',`Price` = '".$_POST['Price']."', `Model` = '".$_POST['Model']."' WHERE `ID` = ".(int)$edit_id;
$_POST['Price']
как минимум сломает ваш запрос (одной кавычки будет достаточно), а как максимум позволит специально подготовленной строкой снести к чертям всю БД?