CODEWITHSUNDEEP
phpmysql
Abhinav Joshi
Abhinav Joshi

Reputation: 101

file upload in php to mysql

I am trying to make a simple file upload from php to mysql and downloading it back but i keep to seem on running into a problem, but I can't figure it out. The picture that I try to upload in this form creates some content in the blob column but on download widows viewer gives and error of no preview available

Here's the code for the form

<form enctype="multipart/form-data" method="post" action="upload.php">
Choose your file <input name="file" type="file">
<input type="submit" >
</form>

Here's the code for upload.php

include('connect.php');
$actualname=$_FILES['file']['name'];
$type=$_FILES['file']['type'];
$name  = $_FILES['file']['tmp_name'];
$size = $_FILES['file']['size'];

$fresource=fopen($name,'r');
$content=fread($fresource,filesize($name));;
$content=addslashes($content);
fclose($fresource);

$query='INSERT INTO `files` (Name,Content,Type,Size) VALUES ("'.$actualname.'","'.$content.'","'.$type.'","'.$size.'")';
echo $query;
$var=mysql_query($query,$con);

and here's the code for download.php

include('connect.php');
$query='SELECT * FROM `files` WHERE ID="2"';
$res=mysql_query($query,$con);
$var=mysql_fetch_array($res);
header("Content-length: ".$var[4]);
header("Content-type: ".$var[3]);
header("Content-Disposition: attachment; filename=".$var[1]);
echo $var[1];

Any help would be much appreciated

The files table has the ID,Name,Content,Type,Size columns in the same order

Upvotes: 1

Views: 556

Answers (1)

Danilo Kobold
Danilo Kobold

Reputation: 2581

DONT USE MYSQL_*

also addslashes() is a terrible and falible way to secure your code. As it is the code is susceptible to SQL injection.

i'm assuming that your database is 

id name content type size

so change the last line to

echo stripslashes($var[2]);

since 

0 => id,
1 => name,
2 => content,

and you added slashes to the content... so now you need to remove em.

Upvotes: 1

Related Questions