更新旧版XML代码以包含上载功能

I've got a legacy password protected website written in php/xml that I would like to update some of the functionality. Currently, the administrator can create multiple Contract Vehicles (CV) and then create a Task Order (TO) that is linked to a specific contract vehicle. The admin can then create a TO File Attachment Record and link/upload a document (i.e. PDF, doc, excel, etc.) that is link to the TO File Attachment record in a mysql database. I'd like to make an enhancement where the site admin can upload a file (i.e., PDF, text, doc, jpeg, tiff, etc.) either when creating a TO File Attachment Record or can be added later via an edit function to a specific TO File Attachment Record. In both instances the file (file link path) would be displayed for the specific TO File Attachment Record. The TO File Attachment Record information is displayed via three (3) different xml pages:

[list.xml / Show List of File Attachment Records Code - BEGIN]
(This is where the details of a specific TO File Attachment Record are displayed along with a list of file attachments associated with saidTO File Attachment Record. From here the admin can "add" a new TO File Attachment Record (by selecting the ADD button, view an existing TO File Attachment Record (by selecting the DETAILS button), or "delete" and existing TO File Attachment Record (by selecting the DELETE button).

   <form>

<subtitle>Task Order - File Attachments</subtitle>

<fields>
    <_count header="No" suffix="." width="30" align="center" />
    <tofiles_title header="Title" align="left" />
    <tofiles_post_date header="Date" type="date" params="M j, Y" align="center" width="100" />
</fields>

<header>
    <titles>true</titles>
    <buttons>
        <delete onclick="" button="addnew" >
            <location>index.php?sub=tofiles&action=add&tofiles_relation={RELATION}&tofiles_type={TYPE}&returnurl={CURRENT_PAGE}</location>
        </delete>
    </buttons>
</header>

<vars>
    <relation import="$_GET['sup_id'] ? $_GET['sup_id'] : $_GET['product_id']" type="eval" />
    <type import="$_GET['sup_id'] ? '1' : '2'" type="eval" />
</vars>


<buttons>
    <delete onclick="" button="delete" >
        <location>javascript:if(confirm('Are you sure you want to delete this record ?')) window.location='index.php?sub=tofiles&action=delete&tofiles_id={NOTE_ID}&returnURL={CURRENT_PAGE}'</location>
    </delete>

    <details onclick="" button="details" >
        <location>index.php?sub=tofiles&action=det&tofiles_id={TOFILES_ID}&returnurl={CURRENT_PAGE}</location>
    </details>

</buttons>

<SQL>
    <vars>
        <sql_table import="$this->tables['tofiles']" type="eval"/>
        <relation import="$_GET['sup_id'] ? $_GET['sup_id'] : $_GET['product_id']" type="eval" />
        <type import="$_GET['sup_id'] ? '1' : '2'" type="eval" />
        <sql_condition import="WHERE tofiles_type='{TYPE}' AND tofiles_relation='{RELATION}' " type="var"/>
    </vars>

    <query>SELECT * FROM `{SQL_TABLE}` {SQL_CONDITION} ORDER BY tofiles_post_date DESC</query>
</SQL>

<items>100</items>

</form>

[list.xml / Show List of File Attachment Records Code - END]

[details.xml / Show TO File Attachment Record Details Code - BEGIN]
(This is where the Admin/Users could select a link to download the attached file.)

<form>
<title>T/O Attachment Details</title>
<action>#</action>
<name>edit</name>
<width>580</width>

<formtag>true</formtag>
<border>true</border>

<buttons>
    <set>
        <footer>true</footer>
        <header>true</header>
    </set>

    <return onclick="" button="return" >
        <location>{PRIVATE.FORM_PREVIOUS_PAGE}</location>
    </return>

    <save onclick="" button="edit">
        <location>index.php?sub=tofiles&action=edit&tofiles_id={TOFILES_ID}&returnurl={CURRENT_PAGE}</location>
    </save>

</buttons>

<redirect>index.php?sub=users</redirect>

<vars>
    <returnurl import="urldecode($_GET[returnURL])" type="eval" />
</vars>

<fields>


    <user_id type="hidden" hidden="true"/>

    <tofiles_title type="text">
        <title>Title</title>
    </tofiles_title>

    <tofiles_body type="text" valign="top" font="normal">
        <title>Description</title>
    </tofiles_body>

    <subtitle_log type="subtitle" title="Log Data" />

    <tofiles_post_date type="text" action="date" params="F j, Y, g:i a">
        <title>Post Date</title>
    </tofiles_post_date>

    <tofiles_post_ip type="text">
        <title>Post Ip</title>
    </tofiles_post_ip>

    <tofiles_post_user type="relation">
        <title>Post User</title>
        <relation table="users" id="user_id" text="user_login" />
    </tofiles_post_user>

</fields>
</form>

[details.xml / Show TO File Attachment Record Details Code - END]

[Screen Print - details.xml - Sorry, your system won't allow me to post screen prints]

[add.xml / Add/Edit TO TO File Attachment Record Information - BEGIN]

(This is where the Admin would "upload" the file to the Web server along with the file path to the database.)

<form>
<title>{PRIVATE.FORM_ACTION_TITLE} T/O - FFFile Attachments</title>
<action>index.php?sub=tofiles&action=store</action>
<name>edit</name>
<width>580</width>

<formtag>true</formtag>
<border>true</border>

<buttons>
    <set>
        <footer>true</footer>
        <header>true</header>
    </set>

    <return onclick="" button="return">
        <location>{PRIVATE.FORM_PREVIOUS_PAGE}</location>
    </return>

    <save onclick="" button="saveall">
        <location>javascript:document.forms[0].submit();</location>
    </save>

</buttons>

<redirect>index.php?sub=accounts</redirect>

<fields>
    <tofiles_id type="hidden" hidden="true"/>
    <tofiles_post_date type="hidden" default="time()" action="eval"/>
    <tofiles_post_user type="hidden" default="$_SESSION[minibase][raw][user_id]" action="eval"/>
    <tofiles_post_ip type="hidden" default="$_SERVER[REMOTE_ADDR]" action="eval"/>
    <tofiles_relation type="hidden" default="$_GET[tofiles_relation]" action="eval"/>
    <tofiles_type type="hidden" default="$_GET[tofiles_type]" action="eval"/>

    <tofiles_title type="textbox" size="35" required="true" validate="A:2:200">
        <title>Title</title>
    </tofiles_title>

    <tofiles_body type="textarea" size="60:5" required="true" validate="A:1:100000">
        <title>Body</title>
    </tofiles_body>

</fields>

</form>

[Add/Edit TO TO File Attachment Record Information - END]

[Screen Print - add.xml - Sorry, your system won't allow me to post screen prints]

Once uploaded the admin and other users would be able to view TO File Attachment Record information and select a file link to download the aforementioned document that is associated with that specific TO.

So, like I said, this is a legacy Website and I don't have a lot of experience in writing XML code, so I would appreciate anyone who could provide a little insight. THX!

Enhancement Comments:
The enhancement request is pretty straight-forward: When either creating a TO File Attachment Record that is related to a Task Order (TO), or later during the edit of said TO File Attachment Record, I want to be able to attach/upload a document(s) to the TO File Attachment Record (i.e., PDF, doc, etc.) in the mysql database (add.xml Web page above). This would allow viewers of said TO to be able to view the TO record information along with selecting an attachment link to download and view associated (linked) documents (details.xml Web page above). I can provide more detailed information later (i.e., db table schema, etc.) but that's the nuts and bolts of the enhancement.