Image Database problem..

cainscripter

Hi there,

I'm very new to php and need some help. I am trying to set up a cms where I can upload and then retrieve images from a database. I am able to upload images fine however when I go to retrieve the images I get the same image every time. Here is the code for the file that retrieves the image from the database...

<?php
mysql_connect("localhost", "root", "") or die(mysql_error());
mysql_select_db("resolve");
$result = mysql_query(sprintf("SELECT * from image WHERE title = %d", $_GET['id']));
$row = mysql_fetch_array($result);
header(sprintf("Content-type: %s", $row['FileType']));
print $row['Image'];
?>

theelectricwiz

Just as a started try to remove sprintf from your code. PHP is very cool and doesn't actually need it.

<?php
mysql_connect("localhost", "root", "") or die(mysql_error());
mysql_select_db("resolve");
$result = mysql_query(sprintf("SELECT * from image WHERE title = %d", $_GET['id']));
$row = mysql_fetch_array($result);
header(sprintf("Content-type: %s", $row['FileType']));
print $row['Image'];
?>

becomes

<?php
mysql_connect("localhost", "root", "") or die(mysql_error());
mysql_select_db("resolve");
$result = mysql_query("SELECT * from image WHERE title = $_GET[id]");
$row = mysql_fetch_array($result);
header("Content-type: $row[FileType]");
print $row['Image'];
?>

instead of printing the image try just printing what is returned by mysql when you do that request and try printing the query you end up with like:

<?php
mysql_connect("localhost", "root", "") or die(mysql_error());
mysql_select_db("resolve");
$query = "SELECT * from image WHERE title = $_GET[id]";
$result = mysql_query($query);
print $query;
while ($row = mysql_fetch_array($result)) {
    print_r($row);
}
?>

That may help you find out what's going on. Post what it returns if you still need help.

laserlight

theelectricwiz wrote:
Just as a started try to remove sprintf from your code. PHP is very cool and doesn't actually need it.

Unfortunately, your suggested code is vulnerable to SQL injection, but the original code is not since the %d format specifier for sprintf() formats $_GET['id'] as an integer. If you want to concatenate incoming variables to build an SQL statement, you must either escape them (with [man]mysql_real_escape_string/man) or cast them (to int, as in this case).

theelectricwiz

ah true. So it is. Thank you for pointing that out.