Update a BLOB

Hi guys,

I currently have a site that lets the user upload a image into the DB blob fields... The user can replace the image in the db with a new one.

Note: At one stage I did try to put the path into the DB, but I couldn't get it to work so I am back to putting images in the DB.

However it just doesn't work, with basically the same code. I get the confirmation message but when I go to take a look theres nothing there. In phpmyadmin the blob has (6.5 KB) but I don't know why as the image isnt that size.

Code:

PHP Code:

---

       //code in image path
      $filepath1='/.../img/.../';
    $filepath1 .=$_REQUEST['picture1'];
    //handle code for first image
    $isize=filesize($filepath1);
    $hndl=fopen($filepath1,"rb");
    //Display error message if no file is uploaded
    if (!$hndl) {
    echo "Cannot open file"; }
    //Add image data to variable for inserting
    $imgdata="";
    while(!feof($hndl)){
    $imgdata.=fread($hndl,$isize);
    }; 
    $imgdata=addslashes($imgdata);    

     //insert new product details into the product table
        $sql = "UPDATE product SET 
    ProductImage = '". $imgdata ."'
    WHERE ProductID = '$productid'";

    $result = mysql_query($sql);

    //close handles
    fclose($hndl); 
    exit; 


---

Am not sure why as its the same code as the INSERT, with basically just "UPDATE" changed. Thanks for your help.

what was wrong with storing file paths? I mean, what went wrong? it would be way more efficient to do it that way.

anyway, shouldn't you be defining $filepath1 as the $_FILES['picture1']['tmp_name'], and just be reading the data from that? rather than reading it from some directory (how did the image even get to that directory? moving it and then reading it/storing it doesn't sound very efficient, either!)?

BLOB fields are a disaster area. I don't personally feel databases should be used for storing binary data. There is nothing more efficient about it — the point of a database is to be able to run queries against it, and you can't run a query against binary data — and the code to make it work is unnecessarily convoluted. You cannot simply read file data into an SQL query as you have done there: any file could be constructed to break your query and manipulate your database. Instead you must sanitise it in the same manner as regular user input (using a function like mysql_real_escape_string) or pass it in a parameter. The first method is very expensive and both methods place unnecessary load on the link with your database server.

Leave files out of the database.

Thanks for your replies.

The last upload talk we had was on thread 552972.

Using the php.net examples just wouldn't work. I made sure the permissions were correct but kept getting the else error message.

Code:

---

//condensed form example
<form name='order' method="post" action="<?PHP echo $_SERVER['PHP_SELF']. '?UploadProduct=yes';?>" encytype="multipart/form-data">
<input name="picture1" type="file" id="picture1"  size="60">
<input name="btn_upload" type="submit" id="btn_upload" value="Upload Product"/>
</form>

---

PHP Code:

---

    $uploaddir = '/../img/../';
    $uploadfile = $uploaddir . basename($_FILES['picture1']['name']);
 
    echo '<pre>';
    if (move_uploaded_file($_FILES['picture1']['tmp_name'], $uploadfile)) {
    echo "File is valid, and was successfully uploaded.\n";
    } else {
        echo "Possible file upload attack!\n";
    }

    echo 'Here is some more debugging info:';
    print_r($_FILES);
    
    print "</pre>";    

   //insert new product details into the product table
   $sql = "INSERT INTO product SET
   ImageSmall = '". $thumbnail ."'";
   $result = mysql_query($sql); 


---

I have other fields in the form and insert statement that go through, but not the image this way. I get the following error messages:

Notice: Undefined index: picture1 in /../...php on line 272

Possible file upload attack!
Here is some more debugging info:Array
(
)

you mentioned earlier that your original insert script was working fine, but in this case, your $_FILES array is completely empty. what did you change to break it?

make sure you're not submitting via GET (which it doesn't look like you are from the form you posted), that file_uploads are on in your PHP ini (this should also already be on), and that you're not submitting this form inside of another form.

My old script that worked is in the first post.

This inserted a BLOB into the database. With the new script I am trying to:

1) upload the file to the server folder structure
2) insert the filename into the image field in the product table

(Which I assume my modified example code should be doing)

Also my hoster told me file_uploads is on... I'm not sure why the $_FILES array is empty. The form isn't inside another form, the method is POST and the field is named as per the code (picture1).... is should be outputting something like:

[picture1] => Array
(
[name] => filename.jpg
... etc
)

Just thinking about it I will need to create another field in the DB to store the filename varchar (rather then a BLOB). .... edit: Have now done this, though still getting the notice about picture1 not being defined and the array being empty.

$picture1=mysql_real_escape_string($_POST['picture1']); shouldn't be stipping anything in the filename either? According to my error its got nothing to strip anyway ;)

Will keep looking as it must be something simple to get me past this early stage.

I have tried another simple example that seems to work for other people but not for me.

This is the code:

PHP Code:

---

$uploaddir = '/usr/../../products/';
$filename = $_FILES['picture1']['name'];
$filesize = $_FILES['picture1']['size'];
$tmpname_file = $_FILES['picture1']['tmp_name'];
if($filesize > '5000000') {
echo "This file is to big to upload.";
} else {
move_uploaded_file($tmpname_file, "$uploaddir$filename");
echo "Image upload successful to ".$uploaddir.$filename;
} 


---

The output is:

Code:

---

many Notice: Undefined index: picture1 in /../...php on line 217
Image upload successful to /usr/.../products/

---

But theres no image uploaded. Or filename added to database record. I also changed the code from ['picture1'] to [$picture1] and it said undefined index filename.jpg so I know its getting the information its just not getting it right. echo "testing $filename = " . $filename; outputs testing =

Any help would be great... will have to go back to storing BLOBs if these simple examples don't work.

Thanks

Is the file maybe too big so it fails? How big is the file you're trying to upload? Maybe the settings in php.ini need to be changed first.