<?php
$valid_extensions = array('jpeg', 'jpg', 'png', 'gif', 'bmp' , 'pdf' ); // valid extensions
$path = "../photo/check/" ; // upload directory
if( $_FILES['car_check'])
{

$img = $_FILES['car_check']['name'];
$tmp = $_FILES['car_check']['tmp_name'];
$contract_id = $_POST['contract_id'];
// get uploaded file's extension
$ext = strtolower(pathinfo($img, PATHINFO_EXTENSION));
$final_image = $contract_id.random_int(100, 999).".".$ext;
// check's valid format
if(in_array($ext, $valid_extensions)) 
{ 
$path = $path.strtolower($final_image); 
    if(move_uploaded_file($tmp,$path)) 
    {
    include "../actions/dbPDO.php";
    $sql=$db->prepare("UPDATE contracts SET  carcheck = ?
    WHERE contract_id = ?");
    $sql->bindParam(1,$path);
    $sql->bindParam(2,$contract_id);
    if($sql->execute()){
        echo "<img src='$path' />";
    }
    else 
{
echo 'invalid';
}
}
} }
?>