haller.php | @ sercaneralsan'ın Haller.js'inin PHP portu

First of all, your code example blindly trusts the client, it accepts any file, and allows to choose arbitrary target locations by passing a path as the filename! Never use client data without validating/sanitizing it, trusting the file date provided by the client can lead to all sorts of vulnerabilities!!!

That being said, usually you either use a separate field for the file upload, or a custom database type that doesn't transform the data when it is being marshalled, so that you can transform it manually afterwards. Currently you seem to use the field for the upload that is supposed to hold a string in the database, hence the marshaller will try to convert the input to a string, and that will of course fail.

So for example, rename the form control from image to image_file (no such column should exist in the database), add proper validation rules for image_file, something along the lines of this, to ensure that the upload is valid, ie check the type, the size, the name, etc: