สอบถามหน่อยครับ จาก ตะกร้า ของเว็บthaicreate ตอนหน้า checkout ถ้าผมจะ upload รูปด้วย ต้องทำยังไงหรอครับ

<?php
session_start();

mysql_connect("localhost","root","root");
mysql_select_db("project");
mysql_query("SET NAMES UTF8");
  $Total = 0;
  $SumTotal = 0;
  $todo = $_GET[todo];
  $strOrderID = $_POST[OrderID];
  $OrderDate = $_POST[OrderDate];
  $Name = $_POST[Name];
  $Address = $_POST[Address];
  $Tel = $_POST[Tel];
  $Email = $_POST[Email];
  $pri = $_POST[pri];
  $status = $_POST[status];
  $all_qty = $_POST[qty];
if ($todo=="insert"){ 


  if(move_uploaded_file($_FILES["filUpload"]["tmp_name"],"image/".$_FILES["filUpload"]["name"]))
  {
  $strSQL = "INSERT INTO tbl_orders (OrderDate,Name,Address,Tel,Email,pri,status,qty,img)
	VALUES('".date("Y-m-d H:i:s")."', '$Name', '$Address', '$Tel', '$Email', '$pri','$status', $all_qty,'".$_FILES["filUpload"]["name"]."') ";
  $resultsql = mysql_query($strSQL) or die(mysql_error());
  }
  $strOrderID = mysql_insert_id();
  $strSQL2 = "INSERT INTO tbl_user (mem_Name, mem_Tel, mem_Add, mem_Email, mem_Status)
  VALUES( '$Name', '$Tel', '$Address', '$Email', '$status') ";
  $resultsql = mysql_query($strSQL2) or die(mysql_error());

  for($i=0;$i<=(int)$_SESSION["intLine"];$i++)
  {
	  if($_SESSION["strProductID"][$i] != "")
	  {
			  $strSQL = "
				INSERT INTO orders_detail (OrderID,pro_Id,Qty)
				VALUES
				('".$strOrderID."','".$_SESSION["strProductID"][$i]."','".$_SESSION["strQty"][$i]."') 
			  ";
			  mysql_query($strSQL) or die(mysql_error());
	  }
  }
  
  header("location:finish_order.php?OrderID=".$strOrderID);
         /* if ($resultsql) {
            echo "<h1>Insert Compleated</h1>";
            echo '<meta http-equiv="refresh" content="2; URL=finish_order.php">';
        }*/
  
  }elseif ($todo=="update") {
	  $strSQL = "UPDATE orders 
	  SET Name='$Name', Address='$Address', Tel='$Tel', Email='$Email', status='$status' 
	  WHERE OrderID = '$OrderID' ";
  $resultsql = mysql_query($strSQL) or die(mysql_error());
  
}
	
	header("location:finish_order.php?OrderID=".$strOrderID);
        /*if ($resultsql) {
            echo "<h1>UPDATE Compleated</h1>";
            echo '<meta http-equiv="refresh" content="2; URL=view_order.php">';
        			  }*/
mysql_close();

session_destroy();


?>

<?php /* This code download from www.ThaiCreate.Com */ ?>

<form name="form1" method="post" action="save_checkout.php?todo=insert" enctype="multipart/form-data">
  <table width="304" border="1">
    <tr>
      <td width="71">Name</td>
      <td width="217"><input type="text" name="Name"></td>
    </tr>
    <tr>
      <td>Address</td>
      <td><textarea name="Address"></textarea></td>
    </tr>
    <tr>
      <td>Tel</td>
      <td><input type="text" name="Tel"></td>
    </tr>
    <tr>
      <td>Email</td>
      <td><input type="text" name="Email"></td>
    </tr>
    <tr>
      <td>image</td>
      <td><input type="file" name="filUpload"></td>
    </tr>

    <input type="hidden" name="status" value="1">
  </table>
    <input type="submit" name="Submit" value="Submit">
</form>
<?php
mysql_close();
?>

<?php
session_start();

mysql_connect("localhost","root","root");
mysql_select_db("project");
mysql_query("SET NAMES UTF8");
  $Total = 0;
  $SumTotal = 0;
  $todo = $_GET[todo];
  $strOrderID = $_POST[OrderID];
  $OrderDate = $_POST[OrderDate];
  $Name = $_POST[Name];
  $Address = $_POST[Address];
  $Tel = $_POST[Tel];
  $Email = $_POST[Email];
  $pri = $_POST[pri];
  $status = $_POST[status];
  $all_qty = $_POST[qty];


move_uploaded_file($_FILES["filUpload"]["tmp_name"],"image/".$_FILES["filUpload"]["name"])
exit;


if ($todo=="insert"){ 


  if(move_uploaded_file($_FILES["filUpload"]["tmp_name"],"image/".$_FILES["filUpload"]["name"]))
  {
  $strSQL = "INSERT INTO tbl_orders (OrderDate,Name,Address,Tel,Email,pri,status,qty,img)
	VALUES('".date("Y-m-d H:i:s")."', '$Name', '$Address', '$Tel', '$Email', '$pri','$status', $all_qty,'".$_FILES["filUpload"]["name"]."') ";
  $resultsql = mysql_query($strSQL) or die(mysql_error());
  }
  $strOrderID = mysql_insert_id();
  $strSQL2 = "INSERT INTO tbl_user (mem_Name, mem_Tel, mem_Add, mem_Email, mem_Status)
  VALUES( '$Name', '$Tel', '$Address', '$Email', '$status') ";
  $resultsql = mysql_query($strSQL2) or die(mysql_error());

  for($i=0;$i<=(int)$_SESSION["intLine"];$i++)
  {
	  if($_SESSION["strProductID"][$i] != "")
	  {
			  $strSQL = "
				INSERT INTO orders_detail (OrderID,pro_Id,Qty)
				VALUES
				('".$strOrderID."','".$_SESSION["strProductID"][$i]."','".$_SESSION["strQty"][$i]."') 
			  ";
			  mysql_query($strSQL) or die(mysql_error());
	  }
  }
  
  header("location:finish_order.php?OrderID=".$strOrderID);
         /* if ($resultsql) {
            echo "<h1>Insert Compleated</h1>";
            echo '<meta http-equiv="refresh" content="2; URL=finish_order.php">';
        }*/
  
  }elseif ($todo=="update") {
	  $strSQL = "UPDATE orders 
	  SET Name='$Name', Address='$Address', Tel='$Tel', Email='$Email', status='$status' 
	  WHERE OrderID = '$OrderID' ";
  $resultsql = mysql_query($strSQL) or die(mysql_error());
  
}
	
	header("location:finish_order.php?OrderID=".$strOrderID);
        /*if ($resultsql) {
            echo "<h1>UPDATE Compleated</h1>";
            echo '<meta http-equiv="refresh" content="2; URL=view_order.php">';
        			  }*/
mysql_close();

session_destroy();


?>

<?php /* This code download from www.ThaiCreate.Com */ ?>

move_uploaded_file($_FILES["filUpload"]["tmp_name"],"image/".$_FILES["filUpload"]["name"]);
exit;