0

I am having trouble uploading an image into my database. Now the form send and processes successfully however it does not properly send when I put the variable containing the file_get_contents information. So here is my code so far. 

<?php if (isset($_POST['submit-ads'])) { $filename = $_FILES["file_uploaded"]["name"]; $filecontent = $_FILES["file_uploaded"]["tmp_name"]; $filesize = $_FILES["file_uploaded"]["size"]; $filetype = $_FILES["file_uploaded"]["type"]; if ($filetype == "image/png" || "image/jpeg" || "image/bmp") { if ($filesize > 0 && $filesize < 1000000000) { if ($newContent = file_get_contents($filecontent)) { if ($conn = mysqli_connect("localhost", "root", "", "smartlea_browser_extensions")) { $newQuery = "INSERT INTO `food`(`image`, `imagename`, `access_token`) VALUES('".$newContent."', '".$filename."', '123')"; if ($query = mysqli_query($conn, $newQuery)) { echo 'Works erase this line'; } else { die("Could not insert file".mysqli_error($conn)); } } else { die('Could not connect to mysql'); } } else { die('ERROR getting file content. Invalid filepath'); } } else { die('Invalid filesize'); } } else { die('Image type not supported'); } } ?>

Now this does not work. Again the issue lies on the line performing the query. When I put $newContent into the field. It throws this error 

Could not insert fileYou have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'P�$�>�̒��(j�d�nf��� 5I�O7������$٧�Y�sqEM���' at line 1

Can someone shed some light on why this is not working? What I am trying to do is just upload an image into my database. Please do not recommend saving it into a folder because there is a strict reason I am doing it this way. Now no ajax is involved. Just that PHP code (Which is a snippet but everything involved in that function) The error is above if you need any other information let me know.

Improve this question
6
  • You're trying to send binary data through a text-based protocol. Commented Sep 2, 2016 at 20:24
  • $newQuery = "INSERT INTO food (image, imagename, access_token) VALUES('".$newContent."', '".$filename."', '123')"; Commented Sep 2, 2016 at 20:26
  • Anant that didnt solve the problem it gave the same error. Commented Sep 2, 2016 at 20:31
  • First off, read this as to whether you should store images in a database. Second, if you still want to store images in a database, you should be using a binary column ("blob") and binding the image data with send_long_data. Commented Sep 2, 2016 at 20:32
  • @tkausl what do you mean text protocol? Commented Sep 2, 2016 at 20:33

3 Answers 3

Reset to default
3

You need to use the function mysqli_real_escape_string to make sure your file contents doesn't break your sql query. Like so:

$newContent = mysqli_real_escape_string($conn, $newContent); // Now run the query

Even better, use prepared statements, read more on this here.

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

0

Please be very careful with these types of INSERT queries. You are vulnerable to SQL Injection attacks like these. The error you are getting is a red flag for these types of attacks. The data you are inserting in your query contains characters that are not supported.

Change the column image to type LONGBLOB. And please read up on SQL Injection vulnerabilities. At least sanitize your input or use Parameterized Queries

Improve this answer

3 Comments

So you think its because its not longblob? Let me go check my database be right back.
No. Not entirely. However storing images should be in a LONGBLOB. The issue is that you are appending characters to your query that are not recognised by MySQL. Because they are the file content (IIRC this is base 64)
Alright. I'm assuming that after escaping that it works now. This however still does NOT fix the SQL Injection vulnerability in your query. Good to hear it works!
-1

Change your image type in your database to varchar and save the path of image in your database. You can also move the uploaded file in destination path with move_uploaded_file() method.

http://php.net/manual/fr/features.file-upload.php

Improve this answer

3 Comments

I need to use blob. My retrieve method fetches a blob type then uses base64 encoding
Who marked this down? This is not a bad answer. Logical but my program just doesnt call for it.
@user6750159 but it doesn't do anything to help solve the question. It offers a suggestion to change your application rather than solving the issue at hand. It would be better suited as a comment or suggestion than an answer. (also, not me)

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.