longblob?

[greatepier]

I want to store an image in my database.
I found an article in http://www.phpbuilder.com/columns/florian19991014.php3?page=2
So I created a table.

CREATE TABLE `binary_data` (
  `id` int(4) NOT NULL auto_increment,
  `gedcom` varchar(15) default NULL,
  `doctype` char(2) default NULL,
  `bin_data` longblob,
  `filename` varchar(50) default NULL,
  `filesize` varchar(50) default NULL,
  `filetype` varchar(50) default NULL,
  PRIMARY KEY  (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=3 ;

Then copies the script from the site and made some small adjustments in names.

<?php
if ($submit) {
    MYSQL_CONNECT("localhost","user","pw");
    mysql_select_db("db");

$data = addslashes(fread(fopen($form_data, "r"), filesize($form_data)));

$result=MYSQL_QUERY("INSERT INTO binary_data (gedcom, doctype, bin_data,filename,filesize,filetype) ".
    "VALUES ('$gendoc','$doctype','$data','$form_data_name','$form_data_size','$form_data_type')");

$id= mysql_insert_id();
print "<p>This file has the following Database ID: <b>$id</b>";

MYSQL_CLOSE();

} else {

// else show the form to submit new data:
?>



<table width="50" border="0">
<form method="post" action="<?php echo $PHP_SELF; ?>" enctype="multipart/form-data">

<tr><td>Gedcom:</td></tr>
<tr><td><input type="text" name="gedcom"  size="15"></td></tr>
<tr><td>Document typy:</td></tr>
<tr><td><input type="text" name="doctype"  size="2"></td></tr>
        <input type="hidden" name="MAX_FILE_SIZE" value="1000000">
<tr><td><br>Bestand/File:</h5> </td></tr>
<tr><td><input type="file" name="form_data"  size="80"></td></tr>
<tr><td><p><input type="submit" name="submit" value="submit">
</form>
</table>


<?php
}
?>

It doesn't even print "This file has the following Database ID: ", so it looks it does n't go to the $submit loop
What am I doing wrong??

[bradgrafelman]

1. Where is $submit ever defined? Or $form_data? Or....? See this manual page to learn how to retrieve variables from external sources (e.g. POST'ed from a form): [man]language.variables.external[/man]. (Also note that $PHP_SELF doesn't exist either; take a look at the $_SERVER array as outlined here: [man]variables.predefined[/man]).

2. It appears as though you're vulnerable to SQL injection attacks. User-supplied data should never be placed directly into a SQL query! Instead, sanitize it with a function such as [man]mysql_real_escape_string/man.

3. You shouldn't use addslashes() when preparing data for a SQL query as the function does not do the same job as mysql_real_escape_string().

4. You could shorten the fred/fopen() combo to simply [man]file_get_contents/man.

5. See this page to learn how to work with file uploads: [man]features.file-upload[/man].

[greatepier]

1. No it is not really defined, but I just copied this from code from the phpbuilder site???
   http://www.phpbuilder.com/columns/fl...14.php3?page=2 ?

Normally I do this a code like:

 
if(isset($_POST['submit '])) {
$gendoc= $_POST['gendoc'];
$doctype= $_POST['doctype'];
$form_data= $_FILE['form_data'];
[code=php] 

$PHP_SELF was in the example code.
I tried this as well  action="add.php" 

2. User-supplied data should never be placed directly into a SQL query! 
Agreed. Normally I have this in a config.php, but again to stay as close as possible to the example script (to get it working)

3.-5 I am a newbee. There are lot's of things to learn.
But should the example code on phpbuilder not just work?

[bradgrafelman]

greatepier wrote:

But should the example code on phpbuilder not just work?

Well your link doesn't work, but if you did get this from a PHPBuilder article, I'd take a wild guess and say that the article wasn't published very recently... so no, you can't simply take the code as provided - you'll have to update it.