PHP wont display images but will upload them

[HaX3]

Hello all,

I cant seem to get it to display images with a space or "_" or "-" but as one word it shows, how to I allow other punctuations?

I am a PHP noob TT_TT

	if($_POST['upload']){

	$target_path = "../images/welcomebanners/";
	include_once("../include/functions.php");

	$target_path = $target_path . time() . basename( $_FILES['banner']['name']); 

	$size = $_FILES['banner']['size'];
	$type = strtolower(substr($_FILES['banner']['name'], strripos($_FILES['banner']['name'], '.')));
	list($width, $height, $typed, $attr) = getimagesize($_FILES['banner']['tmp_name']);

	if($height == 0 || $width == 0){

		echo '<meta http-equiv="refresh" content="0;url=welcomeBanner.php?error=98423"/>';

	} else {

		if($height > 300 || $width > 800){

			echo '<meta http-equiv="refresh" content="0;url=welcomeBanner.php?error=38545"/>';

		} else {

			if($typed == 1 || $typed == 2 || $typed == 3){

				if($size < 102400){

					if(move_uploaded_file($_FILES['banner']['tmp_name'], $target_path)) {

						$image = time() .$_FILES['banner']['name'];

						$username = $_COOKIE["gashuUser"];
						$password = $_COOKIE["gashuPass"];

						$updateTBL = mysql_query("UPDATE users SET banner='$image' WHERE username='$username' AND password='$password'")or die(mysql_error());

						echo '<meta http-equiv="refresh" content="0;url=welcomeBanner.php?info=14627"/>';

					} else{
					    echo '<meta http-equiv="refresh" content="0;url=welcomeBanner.php?error=68452"/>';
					}

				} else {

					echo '<meta http-equiv="refresh" content="0;url=welcomeBanner.php?error=23145"/>';

				}

			} else {

				echo '<meta http-equiv="refresh" content="0;url=welcomeBanner.php?error=98423"/>';

			}

		}

	}

} else {

	echo '<meta http-equiv="refresh" content="0;url=welcomeBanner.php?error=45687"/>';

}

[Weedpacket]

It would help if we could see some of the code that displays the image; but you will probably want to do something with

basename( $_FILES['banner']['name']);

to make sure there are no nasty surprises in the file's name.

[HaX3]

Hey well okay here is the file that displays but i will add that and see if it works 🙂 thank you

		include_once("../include/functions.php");

		if($_GET['error']){
			writeError("Error",error(secure($_GET['error'])));
		} elseif($_GET['info']){
			writeNotice("Notice",info(secure($_GET['info'])));
		}

		$whichUser = secure($_GET['u']);

		$userQuery = mysql_query("SELECT * FROM users WHERE ident='$whichUser'")or die(mysql_error());

		if(mysql_num_rows($userQuery) <= 0){
			echo '<meta http-equiv="refresh" content="0;url=../include/404.htm"/>';
			exit;
		}

		$userDetails = array();

		while($u=mysql_fetch_assoc($userQuery)){
			$userDetails[0] = $u['username'];
			$userDetails[1] = $u['group'];
			$userDetails[2] = $u['photo'];
			$userDetails[3] = $u['aboutme'];
			$userDetails[4] = $u['influences'];
			$userDetails[5] = $u['email'];
			$userDetails[6] = array($u['dobDay'],$u['dobMonth'],$u['dobYear'],$u['dobPref']);
			$userDetails[7] = $u['gender'];
			$userDetails[8] = $u['joined'];
			$userDetails[9] = $u['ip'];
			$userDetails[10] = $u['ident'];
			$userDetails[11] = $u['banner'];
			break;
		}

		$favourites = mysql_query("SELECT * FROM favourites WHERE user='$userDetails[10]' ORDER BY ident DESC")or die(mysql_error());

		$allFavs = mysql_num_rows($favourites);

		if(mysql_num_rows($favourites) <= 0){
			$favs = "<em>".$userDetails[0]." has no favourites at the moment</em>";
		} else {
			$fav = array();
			$fa = 0;
			while($f = mysql_fetch_assoc($favourites)){
				$fav[$fa++] = array($f['chapterID'],$f['seriesID']);
			}	
			$favs = '';
			$n = 0;
			for($i=0;$i<count($fav)&&$n<5;$i++,$n++){
				$thisOne = $fav[$i][0];
				$cover = mysql_query("SELECT * FROM chapters WHERE ident='$thisOne'")or die(mysql_error());
				while($fi=mysql_fetch_assoc($cover)){
					$fcover = $fi['frontcover'];
					$seri = $fav[$i][1];
					$chap = $fav[$i][0];
					$favs .= '<a href="../pages/?series='.$seri.'&chapter='.$chap.'"><img class="mangaImg" style="width:120px;height:170px;" src="../images/frontcover/'.$fcover.'" alt="" /></a> ';
					break;
				}
			}
		}

		$userOwn = (substr($userDetails[0],-1)=="s") ? $userDetails[0]."'" : $userDetails[0]."'s";
			$photoRowspan = ($userDetails[1] > 1) ? 5 : 3;
			$userDetails[4] = (strlen($userDetails[4])<=0)?'<em>No information</em>':$userDetails[4];
			$influences = ($userDetails[1] > 1) ? '<tr><th>Influences</th></tr><tr><td>'.$userDetails[4].'</td></tr>' : '';
			$userDetails[3] = (strlen($userDetails[3])<=0)?'<em>No information</em>':$userDetails[3];
			$personalRowspan = ($userDetails[1] > 1) ? 5 : 3;
			$extras = ($userDetails[1] > 1) ? '<tr><th>favourites></th></tr><tr><td>favourites</td></tr><tr><th>manga</th></tr><tr><td>manga</td></tr>' : '<tr><th>favourites</th></tr><tr><td>favourites</td></tr>';
			$photoImg = (strlen($userDetails[2])>0) ? '../images/photos/'.$userDetails[2] : "http://aquate.us/u/noPhoto.jpg";
			$bannerImg = (strlen($userDetails[11])>0) ? '../images/welcomebanners/'.$userDetails[11] : "../images/profiletempbanner.png";
			$oCol = 1;