Losing data that actually is present in the database...

Ton_Wibier

Hi!

I have a bit of small problem. I'm writing a small application where
a person has the possibility to enter information of articles and
upload pictures (jpg/bmp) at the same time. This is all working well.

For entering the article data, I use the following:

<form enctype="multipart/form-data" action="store.php" method="POST">
<input name="MAX_FILE_SIZE" type="hidden" value="51200">
:
Some more HTML
:
<tr>
<td>Picture</td>
<td><input type="file" name="picture" class="twod" size="90" maxlength="80" id="picture"></td>

</tr>

For modifying the article data, I use the following code:

<form action=\"store.php?articlenr=$artnr\" method=\"POST\">
:
Some more PHP
:
<tr>
<td>Afbeelding</td>
<td><input type=\"file\" name=\"picture\" class=\"twod\" size=\"100\" maxlength=\"80\" value='$picture'></td>

</tr>

The weird part is that, first of all, the BROWSE field does NOT contain
the filename! Also, when I choose a new file with the browse button, it
is not uploaded and the content of the browse field isn't stored into
the database.

The first part, entering NEW article data, is working like a charm!
All the text AND the picture file are stored into the database and
server respectively. So, there's nothing wrong with that.

My question is:
How do I tell the "Modify Article Data" PHP page what the content is of
the variable '$picture', which has the name of the picture file retrieved
from the database? I have tested the content of the variable. Somehow the
"value='$picture'" does not seem to work.

I hope you can help me with this one.

Thanks a million!

Weedpacket

First problem. This is a basic security measure. If I could stick whatever I liked in the file field's value attribute, I could stick, say "/etc/passwd" - or any other file on your system I could guess the name and location of. (There was a big hoo-ha several years back when Netscape first introduced the field type and this vulnerability was discovered).

The solution is to not change the picture if the field is returned blank. If you need the form to tell PHP which file is (not) being modified, use a hidden form field that contains the name.

The second is a lot simpler: you just forgot your enctype encoding, is all.

dalecosp

<input type=\"file\" name=\"picture\" class=\"twod\" 
size=\"100\" maxlength=\"80\" value='$picture'></td>

Well, this is plain HTML, right?

Tried this?

<?
echo "<input type=\"file\" name=\"picture\" class=\"twod\" 
size=\"100\" maxlength=\"80\" value=$picture></td>";
?>

Or, if "short open" is set in php.ini:

<input type=\"file\" 
name=\"picture\" class=\"twod\" size=\"100\" 
maxlength=\"80\" value=<?=$picture; ?>></td>

HTH, (FWIW, I have bad days, too...AAMOF, today might qualify...)

tha_mink

The weird part is that, first of all, the BROWSE field does NOT contain
the filename! Also, when I choose a new file with the browse button, it
is not uploaded and the content of the browse field isn't stored into
the database.

Well yeah...First of all...the browse field will not show data that is on a remote server. I assume the value of $picture is some file on the webserver. The "file" input does not accept a "value" in the way say, text inputs do. Second of all when you use the "file" input..you need to state 'enctype="multipart/form-data" '.

What I would do in your case is print out the thumbnail of the existing image and under that...print the empty "file" input. Then when the form is submitted...check to see if the file input == "" and if it does...do nothing with it. But if the "file" input contains data...then process your image.

The way I actually do it is to use the same form for adding and editing. I assume that when a form is being used for editing i will pass it the info from the database with fetch_object. So I code all my input values to be value="$row->value". If I don't pass it $row, then the inputs are empty. If I do...then they are prefilled with the sql data.

I also always have a hidden input in my forms called $newaction or something like that. Then when I include the form i do it like so...

$newaction = "adding";
include("someform.php");

Then in the form I would do something like this...

<Form action="blah.php" ...>
<input type="hidden" name="newaction" value="<? $newaction;?>
...form stuff here...
<?
if ($newaction == "adding") {
   print"<input type=\"file\" name=\"image\">\n";
} elseif ($newaction == "editing") {
   print"<img src=\"path_to_image.jpg\">";
   print"<input type=\"file\" name=\"image\">\n";
}

Then, on the form processing page...

if ($_POST['image'] == ""){
   //image is empty so don't process image
} else {
  //process image...
}

Not exactly how I do it but...you get the idea..

good luck