Miscellany

case 'submitprod2' :
			if (!isset($_POST['name'] || !isset($_POST['desc']) || !isset($_POST['category'])) //added !isset
			{
				echo 'You did not fill in a title!<br><br>Go <a href="javascript:window.history.back()">back</a> and try again.';
				break; //if they're not set, using them will give you an error  ^
			}
			if( $_FILES['file']['tmp_name'] != "" ){
  			 // Define the upload location
      		  $target_path = "../images/";

        	 // Create the file name with path
        	  $target_path = $target_path . basename( $_FILES['file']['name']); 

        	// Try to move the file from the temporay directory to the defined.
      		  if(move_uploaded_file($_FILES['file']['tmp_name'], $target_path)) {
           		 echo "The file ".  basename( $_FILES['file']['name']). 
                 " has been uploaded<br>";
       		   } 
			   else{
           			echo "There was an error uploading the file, please try again!";
       		   }
				$prod_img = $target_path.$_FILES['file']['name'];
				 
				$_GET['id'] = (int)$_GET['id']; //force int on id, should check if this thing even exists
				$name = mysql_real_escape_string($_POST['name']);//consider the use of mysql_real_escape_string<br />
				$desc = mysql_real_escape_string($_POST['desc']);
				$category = $_POST['category'];
				//we're good, move on.
				$str = "UPDATE `products` SET `prod_name`='$name',`prod_desc`='$desc',`prod_cat_id`='$category',`prod_img`='$prod_img' WHERE `prod_id`=".($_GET['id'])." LIMIT 1"; //removed quotes around the integer field, and added a limit
				$qry = mysql_query($str) or die("There was an error submitting the query: " . mysql_error());
			
			if ($qry)
				echo "Category edited successfully.<br>File modified successfully.<br>";
			
			break;}
			
			else{
			$_GET['id'] = (int)$_GET['id']; //force int on id, should check if this thing even exists
			$name = mysql_real_escape_string($_POST['name']);//consider the use of mysql_real_escape_string<br />
			$desc = mysql_real_escape_string($_POST['desc']);
			$category = $_POST['category'];
				$str = "UPDATE `products` SET `prod_name`='$name',`prod_desc`='$desc',`prod_cat_id`='$category', WHERE `prod_id`=".($_GET['id'])." LIMIT 1"; //removed quotes around the integer field, and added a limit
			$qry = mysql_query($str) or die("There was an error submitting the query: " . mysql_error());
			if ($qry)
				echo "Category edited successfully.<br><br>";
			break;
			}