0

I am having trouble uploading an image into my database. Now the form send and processes successfully however it does not properly send when I put the variable containing the file_get_contents information. So here is my code so far.

<?php
    if (isset($_POST['submit-ads']))
    {
        $filename = $_FILES["file_uploaded"]["name"];
        $filecontent = $_FILES["file_uploaded"]["tmp_name"];
        $filesize = $_FILES["file_uploaded"]["size"];
        $filetype = $_FILES["file_uploaded"]["type"];
        if ($filetype == "image/png" || "image/jpeg" || "image/bmp")
        {
            if ($filesize > 0 && $filesize < 1000000000)
            {
                if ($newContent = file_get_contents($filecontent))
                {
                    if ($conn = mysqli_connect("localhost", "root", "", "smartlea_browser_extensions"))
                    {
                        $newQuery = "INSERT INTO `food`(`image`, `imagename`, `access_token`) VALUES('".$newContent."', '".$filename."', '123')";
                        if ($query = mysqli_query($conn, $newQuery))
                        {
                            echo 'Works erase this line';
                        }
                        else 
                        {
                            die("Could not insert file".mysqli_error($conn));
                        }
                    }
                    else 
                    {
                        die('Could not connect to mysql');
                    }
                }
                else 
                {
                    die('ERROR getting file content. Invalid filepath');
                }
            }
            else 
            {
                die('Invalid filesize');
            }
        }
        else 
        {
            die('Image type not supported');
        }
    }
?>

Now this does not work. Again the issue lies on the line performing the query. When I put $newContent into the field. It throws this error

Could not insert fileYou have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'P�$�>�̒��(j�d�nf���  5I�O7������$٧�Y�sqEM���' at line 1

Can someone shed some light on why this is not working? What I am trying to do is just upload an image into my database. Please do not recommend saving it into a folder because there is a strict reason I am doing it this way. Now no ajax is involved. Just that PHP code (Which is a snippet but everything involved in that function) The error is above if you need any other information let me know.

6
  • You're trying to send binary data through a text-based protocol.
    – tkausl
    Sep 2, 2016 at 20:24
  • $newQuery = "INSERT INTO food (image, imagename, access_token) VALUES('".$newContent."', '".$filename."', '123')"; Sep 2, 2016 at 20:26
  • Anant that didnt solve the problem it gave the same error.
    – Ignatius
    Sep 2, 2016 at 20:31
  • First off, read this as to whether you should store images in a database. Second, if you still want to store images in a database, you should be using a binary column ("blob") and binding the image data with send_long_data. Sep 2, 2016 at 20:32
  • @tkausl what do you mean text protocol?
    – Ignatius
    Sep 2, 2016 at 20:33

3 Answers 3

3

You need to use the function mysqli_real_escape_string to make sure your file contents doesn't break your sql query. Like so:

$newContent = mysqli_real_escape_string($conn, $newContent);
// Now run the query

Even better, use prepared statements, read more on this here.

0
0

Please be very careful with these types of INSERT queries. You are vulnerable to SQL Injection attacks like these. The error you are getting is a red flag for these types of attacks. The data you are inserting in your query contains characters that are not supported.

Change the column image to type LONGBLOB. And please read up on SQL Injection vulnerabilities. At least sanitize your input or use Parameterized Queries

3
  • So you think its because its not longblob? Let me go check my database be right back.
    – Ignatius
    Sep 2, 2016 at 20:35
  • No. Not entirely. However storing images should be in a LONGBLOB. The issue is that you are appending characters to your query that are not recognised by MySQL. Because they are the file content (IIRC this is base 64)
    – Jurriaan
    Sep 2, 2016 at 20:40
  • Alright. I'm assuming that after escaping that it works now. This however still does NOT fix the SQL Injection vulnerability in your query. Good to hear it works!
    – Jurriaan
    Sep 2, 2016 at 20:44
-1

Change your image type in your database to varchar and save the path of image in your database. You can also move the uploaded file in destination path with move_uploaded_file() method.

http://php.net/manual/fr/features.file-upload.php

3
  • I need to use blob. My retrieve method fetches a blob type then uses base64 encoding
    – Ignatius
    Sep 2, 2016 at 20:33
  • Who marked this down? This is not a bad answer. Logical but my program just doesnt call for it.
    – Ignatius
    Sep 2, 2016 at 20:35
  • 1
    @user6750159 but it doesn't do anything to help solve the question. It offers a suggestion to change your application rather than solving the issue at hand. It would be better suited as a comment or suggestion than an answer. (also, not me) Sep 2, 2016 at 20:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.