Image display from Mysql issue

gnrmatt

Hi,

I am having an issue with displaying an image that is uploaded in a mysql database.

The table format is

| id | name | mime | size | data |

The data has uploaded fine. I then have the following script on my 'displayimage.php?imgid=1' page...

$id = $_GET['imgid'];
$result = mysql_query("SELECT * FROM images WHERE id = '$id'");
while($row = mysql_fetch_array($result))
$size = $row['size'];
$mime = $row['mime'];
$name = $row['name'];
{
header("Content-length: $size");
header("Content-type: $mime");
header("Content-Disposition: attachment; filename=$name");
echo $row['data'];

However everytime i try to open this page, Firefox or Internet Explorer just ask's me to try and download the file as a php file. Any ideas what is going wrong?

Thanks!

Matt

NogDog

I think you want to get rid of the "attachment" header() line.

bradgrafelman

Or else use a value for the Content-Disposition header that makes sense with what you're wanting to do. Excerpt from RFC 2183 on the different values that Content-Disposition looks for ("inline" and "attachment"):

RFC 2183 wrote:
2.1 The Inline Disposition Type

A bodypart should be marked `inline' if it is intended to be
displayed automatically upon display of the message. Inline
bodyparts should be presented in the order in which they occur,
subject to the normal semantics of multipart messages.

2.2 The Attachment Disposition Type

Bodyparts can be designated `attachment' to indicate that they are
separate from the main body of the mail message, and that their
display should not be automatic, but contingent upon some further
action of the user. The MUA might instead present the user of a
bitmap terminal with an iconic representation of the attachments, or,
on character terminals, with a list of attachments from which the
user could select for viewing or storage.

EDIT: Also note that user-supplied data should never be placed directly into a SQL query string, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors. Instead, it must first be sanitized with a function such as [man]mysql_real_escape_string/man (for string data; for numeric data, use something like [man]intval/man or equivalent).