CODEWITHSUNDEEP
phpmysqldatabaseimagestore
Booya
Booya

Reputation: 31

Uploaded image not being stored properly in the database (php mysql)

I am trying to store uploaded images in the database. However, the images won't display, and when i take a look at the table with phpmyadmin in the image column i see stuff like [BLOB - 20B] instead of the actual size it should have.

The display script works fine, as i inserted an image through phpmyadmin instead of my upload script and it displayed fine.

My form:

<form id="productForm" action="index.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="product_id" value="' . $values['product_id'] . '" />
<input type="file" name="image" />
</form>

Processing code:

$clean['image'] = mysqli_real_escape_string($dbc, file_get_contents($_FILES['image']['tmp_name']));

mysqli_query($dbc, "
  INSERT INTO product_images (product_id, mime, image)
  VALUES ('{$clean['last_product_id']}', '{$clean['mime']}', '{$clean['image']}')
");

I have omitted everything that is irrelevant cause the other things seem to be working well.

Thanks

Upvotes: 0

Views: 1642

Answers (2)

Booya
Booya

Reputation: 31

Apparently it had something to do with the escaping. I ended up not escaping anything until the actual query, which i formed with sprintf()

$clean['qText'] = sprintf("
  INSERT INTO product_images (product_id, mime, image)
  VALUES ('%d', '%s', '%s')",

  mysqli_real_escape_string($dbc, $clean['last_product_id']),
  mysqli_real_escape_string($dbc, $clean['mime']),
  mysqli_real_escape_string($dbc, file_get_contents($_FILES['image']['tmp_name']))
);

mysqli_query($dbc, $clean['qText']);

Upvotes: 0

Chris Baker
Chris Baker

Reputation: 50592

My apologies that this is not a direct answer to your question, but I would suggest that your approach is not the best one - to the point that I advise you to abandon it if you can.

Storing image data in the database is possible, but it's one of those things that you CAN do, but shouldn't. If your script sees even moderate use, your database can quickly become large and unwieldy. Especially with poor or missing indexes, you can expect your database performance to decline as the table size bloats with each added record.

Added to the database size, there's the additional complexity of maintaining code that can retrieve the image data and output it in a manner that can be used by the client. You aren't going to be able to just print the data, you'll have to send headers to indicate it is an image, which means a separate script, extra http requests, and additional database call.

All around, this is a bad method to use. You're FAR better off writing the file to disk, then storing the path as a string in the database, which is, might I add, much easier to do from a code perspective. It is also infinitely easier to utilize the data later, as well.

Best of luck!

EDIT

Try this to correct your current code, by the way:

$instr = fopen($_FILES['image']['tmp_name'],"rb");
    $image = addslashes(fread($instr,filesize($_FILES['image']['tmp_name'])));
    mysqli_query($dbc, 'INSERT INTO product_images (product_id, mime, image)
      VALUES ("'.$clean['last_product_id'].'", "'.$clean['mime'].'", "'.$image.'")';

Upvotes: 2

Related Questions