uploading image to databse

garfx

hi all,

i'm trying to uplaod an image to my database using the following:

$data = addslashes(fread(fopen($POST[form_data], "r"), filesize($POST[form_data])));

the above works when i do not have to pass the variable as $_ POST

but its coming up with the following error:

Warning: fread(): supplied argument is not a valid stream resource in /home/thefixon/public_html/admin/script.php on line 7

what am i doing wrong?

Gareth

bradgrafelman

Well first of all, you should never be using addslashes() if you're storing the data in a database; instead, you should use [man]mysql_real_escape_string/man.
As for your issue, it would simplify your code quite a bit if you simply use a function such as [man]file_get_contents/man.

Note that when you upload a file from the form, the file's information is stored in the $_FILES array. Read this manual page to learn more about handling file uploads in PHP: [man]features.file-upload[/man].

redrage

I think there was a post about this not to long ago.. last week maybe?

When you make a file form and submit a file it gets stored in the temp. directory ( mine was /var/tmp )

then I think (been a while since i wrote it) i used file() to put that file into an array and then inserted the array into a BLOB. I don't think i did any sort of addslashes()

you can get the temp name and path from the $_FILES array thats created after the form is submitted.

bradgrafelman

redrage wrote:
I don't think i did any sort of addslashes()

Unless you're stuck with using magic_quotes_runtime (in which case I'd say ditch your host and find a competent one :p), you must properly escape the data, less you risk breaking your SQL queries.

And instead of using file(), you could eliminate one step and just use [man]file_get_contents/man.

redrage

bradgrafelman wrote:
Unless you're stuck with using magic_quotes_runtime (in which case I'd say ditch your host and find a competent one :p), you must properly escape the data, less you risk breaking your SQL queries.

And instead of using file(), you could eliminate one step and just use [man]file_get_contents/man.

AHHH you are right yet again :-) I did have to do slashes. (just looked at the code to verify it. and also realized how sloppy i used to be :eek:

bradgrafelman

Even php.net warns people of this on the manual page for [man]mysql_real_escape_string/man:

Escapes special characters in the unescaped_string , taking into account the current character set of the connection so that it is safe to place it in a [man]mysql_query/man. If binary data is to be inserted, this function must be used. [emphasis added]

redrage

Thank you bradgrafelman! its also nice when trying to help someone else you learn something new too :-)

currently re-writing my code to objects and using the new found information in this an other posts. i'm still using a lot of depreciated code from PHP3 days LOL.

when done i'll post it in the critique forum.