[RESOLVED] How do I upload photos to a database

Scooby_Doo

I have a form and right now I just upload the photos with my ftp, what I want to do is upload the photos with that form (if it is possible). and then display the images on my site.

YAOMK

You should define your html form as follows:

<form enctype="multipart/form-data" method="post">
<input type="file" name="image">
<input type="submit" name="upload">
</form>

It is best practice not to store the image to the database, but rather store it in a file and a link to it in your data base. To manipulate the upload you access it via the super-global $_FILES.

Scooby_Doo

Ok, thanks for the link, very helpful.

How would I link it to a database?

bradgrafelman

Well, I usually don't store the images themselves in the database. Rather, I move them to a designated folder and simply store the filename in the database.

If, however, you wanted to actually store the images in the DB, just create a BLOB field, use [man]file_get_contents/man to read the file data into a variable, and insert it as you would any other value (don't forget to sanitize it first like you would all other user-supplied data).

redrage

I don't have exact code for you but this is basically how I did it for my sites.

when you upload the file it sends it to a temp directory with a temp file name.

in the $_POST array there is a field that i think says tmpname or something similar.

input that file into a string to your script and then take that string and store it into the database. you will need to put it into some sort of BLOB field. and depending on how you do it you may need to pull the mime type of the file.

to pull the image and view it in a browser you will need to make a script to query that BLOB field of the table and do createImagefromString (i think is what the function is). you will also need to change the headers of that script to tell the browser that it is an image.

I have read that many people frown on making galleries this way because it is slower. If you index the database right, it is not that bad. It also makes it more difficult for people to steal your images. Most people do not realize they can just rename the image 😃

bradgrafelman

redrage wrote:
in the $POST array there is a field that i think says tmpname or something similar.

Close - it's in the $FILES array, and the index is called 'tmp_name'. More information can be found on this manual page: [man]features.file-upload[/man].

redrage wrote:
It also makes it more difficult for people to steal your images.

How is it any different than serving up a simple .jpg file? Right click -> Save Image As, and there you go.

redrage

WHOOPS your right my bad. $_FILES is right. Thank you for the correction 🙂

when i right click and save my images (from the D😎 they come up with the php filename which is view_image.php

They can save it just fine whole file and all but the average Interweb user will not know that they would need to rename the file to .jpg or what have you. Not very good against people who know what their doing though

Also since it is built in to the script you can do a referrer check to to help people from hot linking.. this can also be done with .htaccess and it is faster with .htaccess as well but if you cannot do that, then it is an option.

Scooby_Doo

Thanks both of you. That information isvery helpful

bradgrafelman

redrage wrote:
they come up with the php filename which is view_image.php

Ah. Whenever I use a PHP script to output an image, I always specify the original filename so that it shows up in a Save As dialog.

redrage wrote:
Also since it is built in to the script you can do a referrer check

Well... don't forget that the referrer header isn't required, and that some browsers and some proxies may strip it (or allow it to be altered to the user's liking).

redrage

bradgrafelman wrote:
Well... don't forget that the referrer header isn't required, and that some browsers and some proxies may strip it (or allow it to be altered to the user's liking).

good point, to those 2% of the users that do this and 90% of those that do... chances are i don't want them to see it anyway LOL.

Seriously though you are right, especially for anything large scale.