Displaying images

UmneyDurak

Hi.
I'm having problems with displaying images, and not sure what I am doing wrong.
I'm storring image name in the db, I don't want to store the whole path in case the location of images on the server changes.
But when I try to display images it doesn't do it.
When image doesn't have ' in it it displays it just fine, but when the name has ' it cuts it of.
For example instead of image path being ./ima'ge.jpg it's ./ima

<?php
...
$image_path= IMAGE_PATH;
$image_path .= $image;
$display_block .= "<table border='1'>
						<tr>
						<td><img src='$image_path'></td>
						<td>'image.php?name=$image_path'</td>

					</tr>							

						</table>";

....
?>
<html>
....
<body>
<?php echo $display_block ?>
</body>
</html>

I tried <img src='image.php?name=$image_path'>
where image.php's code is

<?php
header("Content-type: image/jpg");
$anime=$_GET['name'];
echo $anime;
?>

But when I look at image path in the browser it thinks that image.php?name=$image_path is part of a path.
Thx.

CrashRoX

you need to escape the file names when you enter it into the database, look into addslashes and stripslashed in the php manual

UmneyDurak

Hi.
Sorry I forgot to post I already add slashes when I add name to db.

$name_file=$_FILES['fileupload']['name'];
	$name_image=trim($name_file);
	$name_image=addslashes($name_image);
	//strips all the tags
	$name_file=strip_tags($name_file);

//removes white spaces before and after the name
$name_file = trim($name_file);

//removes white spaces inside the name
$name_file=str_replace(" ", "", $name_file);
$name_image=str_replace(" ", "", $name_image);
$directory= PATH;
$directory .= "/$name_file";
move_uploaded_file($_FILES['fileupload']['tmp_name'], "$directory") or die("Couldn't copy");
chmod("$directory", 0755);

create_anime($_POST['name'],$_POST['userid'], $_POST['ip'], $_POST['revdns'], $_POST['rating'],
							$_POST['placesb'], $_POST['review'], $name_image);

Anyway I tried removing the slashes

$image_path= IMAGE_PATH;
$image_path .= stripslashes($image);
$user_name=get_nick($anime->get_userid());
$display_block .= "<table border='1'>
						<tr>
						<td><img src='$image_path'></td>
						<td>'image.php?name=$image_path'</td>

					</tr>							

						</table>";

And it still cuts of the name near the '.
so path looks like this:
http://localhost/projects/anime/images/evilgu
instead of
http://localhost/projects/anime/images/evilgu'y.gif

mrskhris

It looks like you're putting single quotes around your img src paths. Well, in this case it will be indeed cut on the next single quote.
So, what you can do is either converting single quotes in image names into htmlspecialchars, or enclosing file names into double quotes instead of single ones.

UmneyDurak

In the immortal words of Hommer Simpson: "Doh".
Thx that fixed it. 🙂
I have another question.
When I was searching the forums for solution, I came across someone saying to create a php script

<?php
header("Content-type: image/jpg");
$anime=$_GET['name'];
echo $anime;
?>

When I tried it, it didn't work.
Any ideas whats going on here?
Also it's done this way so that you can have more control over the image being displayed? Like for example you can log some data if someone access the page with that image.
Thx.