File upload does not retrive full path from database

djwinder

Hi all.

I am using the below code for extracting some information from a database. The problem I am having is that while the code works fine for files uploaded without spaces in the file title, if there is a space the code does not work.

The full and correct file name is stored in the database but this code gets to the space and then doesnt continue. For example the file could be "phpbuilder.doc" and it will be fine but if it were "php builder.doc" the below code will only extract the file name to the space and not include the "builder.doc" as such the file links do not work.

If anyone could let me know why this code is not extracting the whole filepath from the database it would be a huge help.

$query = "SELECT * FROM news ORDER BY postdate";
	 $rs = mysql_query($query);	

if($rs && mysql_num_rows($rs) > 0)
{
	 $list = "<table width=\"680\" colspan=\"4\" border=\"0\" cellpadding=\"2\" bgcolor=\"#FFFFFF\">";

while ( $row = mysql_fetch_array($rs))   

{

$list .= "<tr>&nbsp &nbsp &nbsp &nbsp &nbsp &nbsp &nbsp &nbsp &nbsp &nbsp &nbsp &nbsp ........................................................................................................................... &nbsp &nbsp</tr> <br>";
$list .= "<tr><b>Title </b>".$row["subject"]." <b> &nbsp &nbsp &nbsp &nbsp Posted On </b>".$row["postdate"]."</tr> <br>";
$list .= "<tr>".$row["body"]."</tr>";	

if ($row["filepath"] !="")   //there is an associated file so show link
{
  $list .= "<br><br><tr><a href=".$row["filepath"].">Click here </a> to view associated file</tr>";
    }

if ( is_authed() or is_adminauthed() )
  {
        if ($row['memid'] != $_SESSION['userid'])  //if user is same as poster show delete and edit buttons

 {
      $list .= "</tr>";
    }
    else
    {
      $list .= "<br><tr> 

	  <form action=\"viewnews.php\" method=\"post\"  class=\"button\">  
              <input type=\"submit\" name=\"delete\" value=\"Delete\"> 
              <input type=\"hidden\" name=\"newsid\" value=".$row["newsid"]."> </form> 

	  <form action=\"editnews.php\" method=\"post\" class=\"button\">
              <input type=\"submit\" name=\"edit\" value=\"Edit\"> 
              <input type=\"hidden\" name=\"newsid\" value=".$row["newsid"]."> </form> 
	  </tr>";
      $list .= "</tr>";
}

    //elseif ($row['memid'] != $_SESSION['userid'])
  }       

}

$list .= "</table>";

echo ($list);

Weedpacket

If you look at the generated HTML, you'll see that the values of some of your attributes (the href= attribute in the "Click here" link, for example, and the value= attribute in the "newsid" inputs) lack quotes. Without quotes, the value of the attribute ends at the first space.

Also, for URLs (like the href) see [man]urlencode[/man].

bradgrafelman

In other words, make sure your HTML is 100% valid!

Musclebundt

It might be a good idea to get rid of the spaces in your filenames in the first place. Replace them with a "_"
And as the rest have said, make sure your html is valid 😉

djwinder

the problem is that some people who will be using this are likely to use files with spaces so i need to work around that and try and avoid any problems.

so what you are saying is that i need to add single quotes around attributes such as file path in the click here link to get them to complete without quiting at the first space.

Musclebundt

djwinder;10879789 wrote:
the problem is that some people who will be using this are likely to use files with spaces so i need to work around that and try and avoid any problems.

You could use

$file_name = str_replace(" ","_",$file_name);

to replace the spaces with "_".

djwinder

Thank you for that advice i will try and incorportate it into my code 🙂

Musclebundt

djwinder;10879800 wrote:
Thank you for that advice i will try and incorportate it into my code 🙂

No problem, let me hear if you can make it work 😉

bradgrafelman

djwinder wrote:
so what you are saying is that i need to add single quotes around attributes such as file path in the click here link to get them to complete without quiting at the first space.

Well, what we're saying is to use valid HTML code, and with that comes quoting all values. HTML isn't picky - you can use double or single quotes - but it does state that all attributes' values must be quoted.

Musclebundt wrote:
It might be a good idea to get rid of the spaces in your filenames in the first place. Replace them with a "_"

Why might altering the filename be a good idea in this case?

Musclebundt

Maybe it's just me being oldschool, but I generaly don't like spaces in filenames..

djwinder

the code for removing the spaces works perfectly and is a sufficent work around. I think these late nights are making me code blind, I understand the importance of having 100% valid code but thought that i was quoting all values correctly. I will have another look through the code and try to spot the errors. thank you all for the advice and help