1

I'm able to upload a file to mysql but when i download it, the content changes.. example i have test.txt with

"hello"

on it.. when i download it, the test.txt becomes

< pre class='xdebug-var-dump' dir='ltr'>string 'sfasfsafasfsaf' (length=14) sfasfsafasfsaf

not sure, what's wrong..

this is my code for downloading the file:

<?php include("class_lib.php"); 
        $db = new database();
        $db->connect();
    if(isset($_GET["file_id"])){
                    $file_id = $_GET["file_id"];

                    $query = "SELECT filename, filetype, filesize, bin_data " .
                                "FROM file_tbl WHERE id = '$file_id'";

                    $result = mysql_query($query) or die('Error, query failed' . mysql_error());
                    list($filename, $filetype, $filesize, $bin_data) = mysql_fetch_array($result);
                     var_dump($bin_data);  

                    header("Content-length: $filesize");
                    header("Content-type: $filetype");
                    header("Content-Disposition: attachment; filename=$filename");
                    echo $bin_data;

            }
?>

for images also, it downloads but there's no image anymore.. it only shows "no preview available".. is this with my download script above? or maybe this upload script i have:

$fileid = (string) ($lastemp_id + 1);
            $fileName = basename($_FILES['binFile']['name']);
            $extension = pathinfo($fileName, PATHINFO_EXTENSION);
            $fileName .= "_fileid_" . $fileid;
        $fileName = $fileName.".".$extension;
        $tmpName  = $_FILES['binFile']['tmp_name'];
        $fileSize = $_FILES['binFile']['size'];
        $fileType = $_FILES['binFile']['type'];
        $fileDesc = $_POST["txtDescription"];
        $fp      = fopen($tmpName, 'r');
        $content = fread($fp, filesize($tmpName));
        $content = addslashes($content);
                    fclose($fp);

        if(!get_magic_quotes_gpc()){ $fileName = addslashes($fileName); }     

        if (isset($fileName)) {
            $sql = "INSERT INTO file_tbl ";
            $sql .= "(file_desc, bin_data, filename, filesize, filetype) ";
            $sql .= "VALUES ('$fileDesc', '$content',  ";
            $sql .= "'$fileName', '$fileSize', '$fileType')";
            mysql_query($sql, $db->connection) or die('Error: query failed' . mysql_error()); 
            $message =  "File uploaded.<br>"; var_dump($content);
        }
        else $message = "No file uploaded. (opt)";

what is wrong here exactly??

2 Answers 2

1

You're recklessly jamming binary data into your database without even a whiff of proper SQL escaping. What did you expect to happen? This short sample of code is so full of severe SQL injection bugs I hope for your sake it isn't deployed on the public internet.

For your own safety you should immediately stop using the creaky, old, deprecated mysql_query interface and spend the small amount of time necessary to switch your queries to PDO.

You would not have problems like this if you were using placeholders.

What you're seeing is probably the result of your spurious var_dump statement before you output your proper content.

2
  • but thanks anyways, i figured it out.. i was doing single page submission earlier that's why the original file was changed when i downloaded it..
    – Leah
    Nov 16, 2012 at 5:08
  • Please pay attention to your SQL injection bugs. You really, really need to at least use mysql_real_escape_string on any and all values put into your queries.
    – tadman
    Nov 16, 2012 at 5:09
1

Please try this, if upload file is flawless. You can encode your binary data to 64 format when insert into database and also decode before download it.

<?php 
ob_start();     
include("class_lib.php");
$db = new database();
$db->connect();
    if(isset($_GET["file_id"])){
          $file_id = $_GET["file_id"];
          $query = "SELECT filename, filetype, filesize, bin_data " .
                            "FROM file_tbl WHERE id = '$file_id'";

          $result = mysql_query($query) or die('Error, query failed' . mysql_error());
          list($filename, $filetype, $filesize, $bin_data) = mysql_fetch_array($result);
          var_dump($bin_data);  
          ob_end_clean();
          header("Content-length: $filesize");
          header("Content-type: $filetype");
          header("Content-Disposition: attachment; filename=$filename");
          echo $bin_data;
          exit;
  }

?>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.