GR0V shell

<? ob_start();
include "include/connection.php";
$obj=new db();
if($_POST)
{
extract($_POST);
//$isbn=$_POST['isbn'];
//$author=$_POST['author'];


$imageName=$ptype."-".$_FILES['image']['name'];
$source=$_FILES['image']['tmp_name'];
 move_uploaded_file($source, "gallery_images/".$imageName);
 $imagethum=$ptype."-".$_FILES['imagethum']['name'];
$sourcethum=$_FILES['imagethum']['tmp_name'];
 move_uploaded_file($sourcethum, "gallery_thum/".$imagethum);
  $sql= "insert into events (`sno`, `title`, `description`,`proImage`, `proThum`, `type`) values ('', '$name', '$isbn','$imageName', '$imagethum', '$itype')";

$obj->query($sql);
header("location:photogallery.php?id=".$ptype."&st=success");
}