Insert Record form integration with image upload

I'm trying to get my record insertion form to include an image upload option

The image uploading hopefully would support an unlimited number of images, and it would also do the uploading using the same button as the other input fields. Any advice on protecting against sql injection would be greatly appreciated Thanks

Insert Record form (with the upload form in lines 340-349, calls upload_file.php) http://pastebin.com/embed_iframe.php?i=rNk0k32z

upload_file.php (php code that is being called by the form above) http://pastebin.com/embed_iframe.php?i=dPD3CkVu