Inserimento dati in database

<?php
$file=$_POST['filename'];

include "../include/db.php";

$connect=new mysqlclass();
$connect->connect();

	
$fields=json_decode($_POST["fields"]);
$adds=json_decode($_POST["add"]);


$fp = fopen('csv/'.$file, 'r');

// get the first (header) line
$header = fgetcsv($fp);

// get the rest of the rows
$data = array();
$cont=0;
$final="";
while ($row = fgetcsv($fp)) 
{
  	$arr = array();
  	foreach ($header as $i => $col)
  	{
	  	$cont=0;
	  	foreach ($fields as $record) 
	  	{
	  		//echo $col;
			if($record->elem==$i){
				$arr[$fields[$cont]->field] = $row[$i];
				
				
			}
			$cont++;

		}
	}


	$ins="Insert into utenti(";
	$upd="Update utenti set ";
	$where ="";
	$s="";	
	$s1="";
	$flgupd=false;
	$nome="";
	foreach($arr as $row => $col)
	{
		if($s!="")$s.=",";
		if($s1!="")$s1.=",";
		$s.=$row;
		
		if($row=='nome')
		{
				$nome=$arr[$row];
				$nome=str_replace("'","''",$nome);
				$sql="select * from utente where nome='$nome'";
				$res=mysql_query($sql);
				
				if(mysql_num_rows($res)>0)
				{
					$flgupd=true;
					
				}

				//echo $flgupd;
					
				$where.=" where nome='$nome' ";

		}	
		$s1.=$row."='".str_replace("'","''",$arr[$row])."'";
		
	}
	
	foreach($adds as $record){
		if($s!="")$s.=",";

		$s.=$record->field;

		if($s1!="")$s1.=",";

		if($record->val=='')
			$v="''";
		else
			$v=$record->val;

		$s1.=$record->field."=".$v."";

	}

	$s.=",data_ins, provenienza, tipo_prodotto ";
	$upd.=$s1.", data_upd='".date("Y-m-d H:i:s")."', provenienza='".$file."', tipo_utenti='utenti' ".$where.";";
	$ins.=$s.") values(";

	if(!$flgupd){
		$s="";
		foreach($arr as $row => $col)
		{
			
			if($s!="")$s.=",";
			$s.="'".str_replace("'","''",$arr[$row])."'";
			
		}
		foreach($adds as $record)
		{
			if($s!="")$s.=",";
			if($record->val=='')
			$v="''";
			else
			$v=$record->val;
			$s.=$v;
		}
		$ins.=$s.",'".date("Y-m-d H:i:s")."','".$file."','utenti');";
		
		
	}
	
	if($flgupd)
	{
		$res=mysql_query($upd);
		if(!$res) 
		{
			
			$final.="<br/><b>COD PRODOTTO:</b> $nome<br/><span style='color:red'><b>ERROR:</b></span>".mysql_error()."<br/><span style='font-size:9px'>$upd</span><br/>";
		}
	}
	else
	{
		$res=mysql_query($ins);
		if(!$res){
			
			$final.="<br/><b>COD PRODOTTO:</b> $nome<br/><span style='color:red'><b>ERROR:</b></span>".mysql_error()."<br/><span style='font-size:9px'>$ins</span><br/>";
		}
	}

		
   
  $data[] = $ins;
}

echo $final;

//print_r($data);

/*foreach ($arr as $record) {
	echo $record->elem;
	echo $record->field;
}*/
//echo $arr[0]
//print_r($arr);

// $sql="SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS where TABLE_NAME = '".$tabella."'";
// $result=mysql_query($sql) or die(mysql_error());


?>