new at pho plz help me out

hwoarang69

hi can any one plz help me out. iam trying to make a page where user can post pictures. but iam getting error and i have no idea how to fix this.

Notice: Undefined index: image in C:\xampp\htdocs\phpSTUFF\WEB\picture.php on line 15
Please select an image.

error here-line 15---->$file = $_FILES['image']['tmp_name'];

//picture.php
:php:
<html>
<body>
<form action="picture.php" method ="post" enctype="multipart/form-data">
File:
<input type="file" name = "image">
<input type="submit" value="Upload">
</form>

<?php
//connect to database
mysql_connect("localhost", "root", "") or die(mysql_error());
mysql_select_db("uploadsitestorepic") or die(mysql_error());

//file properties
$file = $_FILES['image']['tmp_name'];

if(!isset($file))
echo "Please select an image.";
else
{
$image = addslashes(file_get_contents($FILES['image']['tmp_name']));
$image_name = addslashes($FILES['image']['name']);
$image_size = getimagesize($_FILES['image']['tmp_name']);

   if($image_size == FALSE)
        echo "Thats's not an image!";
   else
   {
    if(!$insert = mysql_query("INSERT INTO store VALUES('', '$image_name',$image)"))
      echo "Problem uploading image!";
    else
    {
      $lastid = mysql_insert_id();
      echo "Image uploaded.<p/>IMAGE:<p/><img src=get.php?id=$lastid>";
    }
   }

}
?>
</body>
</html>
:/php:

Crimsonfox

Try checking if it's set using

if (isset($_FILES['image']['tmp_name'])) {
  $file= $_FILES['image']['tmp_name'];
}

Is this all on the same page? Because the first time it is loaded the form won't have been sent and therefore, not set any of the POST or FILES variables.

hwoarang69

thanks, there are no errors now. only thing is that when i upload a picture it says "Problem uploading image!" the problem is there i think

:php:
if(!$insert = mysql_query("INSERT INTO store VALUES('', '$image_name',$image)"))
echo "Problem uploading image!";
else
{
$lastid = mysql_insert_id();
echo "Image uploaded.<p/>IMAGE:<p/><img src=get.php?id=$lastid>";
}
:php:

Derokorian

Please use

tags to preserve indentation and get code highlighting.

Also I think, <input type="file" name = "image"> maybe where the error is, I think the spacing is a problem. try: <input type="file" name="image">

Also you should check that the form was submitted before trying to use something submitted from the form.

<html>
<body>
<form action="picture.php" method ="post" enctype="multipart/form-data">
File:
<input type="file" name="image">
<input type="submit" name="submit" value="Upload">
</form>

<?php
//connect to database
mysql_connect("localhost", "root", "") or die(mysql_error());
mysql_select_db("uploadsitestorepic") or die(mysql_error());

if( ISSET($_POST['submit']) && $_POST['submit'] == "Upload" )
{
	//file properties
	$file = $_FILES['image']['tmp_name'];

if(!isset($file))
	echo "Please select an image.";
else
{
	$image = addslashes(file_get_contents($_FILES['image']['tmp_name']));
	$image_name = addslashes($_FILES['image']['name']);
	$image_size = getimagesize($_FILES['image']['tmp_name']);


	if($image_size == FALSE)
		echo "Thats's not an image!";
	else
	{
		if(!$insert = mysql_query("INSERT INTO store VALUES('', '$image_name',$image)"))
			echo "Problem uploading image!";
		else
		{
			$lastid = mysql_insert_id();
			echo "Image uploaded.<p/>IMAGE:<p/><img src=get.php?id=$lastid>";
		}
	}
}
}
?>
</body>
</html>

hwoarang69

when ever i upload a jpg image it just says "Problem uploading image!" but when i upload a png image it says this:

Warning: mysql_query() [function.mysql-query]: MySQL server has gone away in C:\xampp\htdocs\phpSTUFF\WEB\picture.php on line 32

Warning: mysql_query() [function.mysql-query]: Error reading result set's header in C:\xampp\htdocs\phpSTUFF\WEB\picture.php on line 32
Problem uploading image!

if(!$insert = mysql_query("INSERT INTO store VALUES('', '$image_name',$image)"))
          echo "Problem uploading image!";
        else
        {
          $lastid = mysql_insert_id();
          echo "Image uploaded.<p/>IMAGE:<p/><img src=get.php?id=$lastid>";
        }

Crimsonfox

hwoarang69;10980141 wrote:
thanks, there are no errors now. only thing is that when i upload a picture it says "Problem uploading image!" the problem is there i think

:php:
if(!$insert = mysql_query("INSERT INTO store VALUES('', '$image_name',$image)"))
echo "Problem uploading image!";
else
{
$lastid = mysql_insert_id();
echo "Image uploaded.<p/>IMAGE:<p/><img src=get.php?id=$lastid>";
}
:php:

Personally I would split off the SQL query var before the IF and then just check the $insert var. Also not sure on the SQL, if you can run it on your server through PHPmyadmin or something it'll show an error, alternatively, note my use of mysql_error();. Gives you a good idea of what is going wrong with the insert.

$insert = mysql_query("INSERT INTO store VALUES('', '$image_name',$image)")

if(!$insert) {
echo "Problem uploading image!";
echo mysql_error();
}
else
{
$lastid = mysql_insert_id();
echo "Image uploaded.<p/>IMAGE:<p/><img src=get.php?id=$lastid>";
}

hwoarang69

iam haveing a problem here. any ideas?

error:
Problem uploading image!You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax



   else
   {
   $insert = mysql_query("INSERT INTO store VALUES('', '$image_name',$image)");
    if(!$insert)
	{
      echo "Problem uploading image!";
	  echo mysql_error();
	  }
    else
    {
      $lastid = mysql_insert_id();
      echo "Image uploaded.<p/>IMAGE:<p/><img src=get.php?id=$lastid>";
    }
   }
  }

bradgrafelman

[man]addslashes/man should never be used to prepare data for a MySQL query. Instead, you should use a DB-specific escaping function such as [man]mysql_real_escape_string/man. The two functions are not interchangeable (since they do not perform the same tasks).

Crimsonfox

Also looking at that query again there's a couple of things:

If you're storing nothing in one of the fields, just specify the fields you're storing in and only store the two you need. Also there's quotes around one variable not another. Something like this:

INSERT INTO store(imgNameField, imgField)
VALUES('" . mysql_real_escape_string($image_name) . "' ,
		 '" . mysql_real_escape_string($image) . "');

hwoarang69

can i put all in one line or i need to put in two lines?

$insert = mysql_query("INSERT INTO store VALUES('".mysql_real_escape_string($image_name)."','".mysql_real_escape_string($image)."')");

bradgrafelman

hwoarang69;10980153 wrote:
can i put all in one line

You can if you'd like, yes, but sometimes long lines of code can be harder to read than ones with more whitespace added.

Also note that the query you've shown does not match the suggestion above; you also need to provide a list of columns that precedes the VALUES section so that MySQL knows which piece of data goes where. Note: You should always do this regardless of whether you're INSERT'ing data into every column in the table; omitting the column list means that you must have the DB schema memorized (or go elsewhere to look it up every time).

Crimsonfox

bradgrafelman;10980154 wrote:
Note: You should always do this regardless of whether you're INSERT'ing data into every column in the table; omitting the column list means that you must have the DB schema memorized (or go elsewhere to look it up every time).

That's a useful piece of information bradgra...grafe....what do I shorten your name to? 😛 I'll go with Brad, cheers for that, it has crossed my mind whether it should always be done or not. =)

hwoarang69

when i upload a picture i get no errors and it says that picture have been uploaded. but picture doesnt get upload. it give me a picture of a broken image. also the picture doesnt go in my store folder.

<html>
<body>
<form action="picture.php" method ="post" enctype="multipart/form-data">
File:
<input type="file" name="image">
<input type="submit" value="Upload">
</form>

<?php
  //connect to database
  mysql_connect("localhost", "root", "") or die(mysql_error());
  mysql_select_db("uploadsitestorepic") or die(mysql_error());

  //file properties
  if (isset($_FILES['image']['tmp_name'])) { 
  $file = $_FILES['image']['tmp_name'];
  }

  if(!isset($file))

   echo "Please select an image.";

  else
  {
       $image = mysql_real_escape_string(file_get_contents($_FILES['image']['tmp_name']));
       $image_name = mysql_real_escape_string($_FILES['image']['name']);
       $image_size = getimagesize($_FILES['image']['tmp_name']);


   if($image_size == FALSE)
        echo "Thats's not an image!";
   else
   {
   $insert = mysql_query("INSERT INTO store(name, image) 
		VALUES('" . mysql_real_escape_string($image_name) . "' , 
     		'" . mysql_real_escape_string($image) . "')"); 
    if(!$insert)
	{
      echo "Problem uploading image!";
	  echo mysql_error();
	  }
    else
    {
      $lastid = mysql_insert_id();
      echo "Image uploaded.<p/>IMAGE:<p/><img src=get.php?id=$lastid>";
    }
   }
  }
?>
</body>
</html>

Crimsonfox

It's because at no point do you put the image anywhere.

move_uploaded_file($_FILES["file"]["tmp_name"],
		"upload/" . $_FILES["file"]["name"]	 );

That moves the temp upload file to a proper location. Obviously doesn't have to be "upload/" could anything you want.

bradgrafelman

Crimsonfox wrote:
It's because at no point do you put the image anywhere.

Sure he does - it's in the INSERT SQL query.

@: Can you show us the code for your 'get.php' script?

Crimsonfox

Ah yeah, my bad, thought that it was just names going into the DB. Not a fan of saving images to DB which probably why I missed it, just a personal opinion though. =)

hwoarang69

// get.php

<?php
//connect to database
mysql_connect("localhost", "root", "") or die(mysql_error());
mysql_select_db("uploadsitestorepic") or die(mysql_error());

$id = addslashes($_REQUEST['id']);

$image = mysql_query("SELECT * FROM store WHERE id = $id");
$image = mysql_fetch_assoc($image);
$image = $image['image'];

header("Content-type: image/png");

echo $image;
?>

Crimsonfox

Get rid of the addslashes and use GET. YOu can always use ISSET with GET to make sure there is an ID set I'll leave that out though. The variable you're using in your SQL query isn't quoted off so it isn't actually a PHP variable.

<?php
//connect to database
mysql_connect("localhost", "root", "") or die(mysql_error());
mysql_select_db("uploadsitestorepic") or die(mysql_error());

$id = $_GET['id']);

$sql = "SELECT image FROM store WHERE id =' " . $id . "' ";
$image = mysql_query($sql);

header("Content-type: image/png");

echo mysql_result($image, 0);
?>

Derokorian

within double quotes ( " ) variables are parsed by the php engine.

bradgrafelman

Crimsonfox;10980210 wrote:
Get rid of the addslashes and use GET.

While you're right in suggesting that addslashes() not be used (it should never be used to prepare data for a MySQL query), not using anything else is even worse.

Instead, if 'id' is a numeric value such as an integer, consider using a function such as [man]intval/man (or casting the data to (int)) for sanitizing purposes.

Also, this:

$sql = "SELECT image FROM store WHERE id =' " . $id . "' ";

will likely never match any row since you've now introduced spaces around the 'id' value (which, by the way, shouldn't be quoted in the first place if it is a numeric value).

@: If you comment out the header() line and visit the get.php page directly in your browser after uploading a new image, do you see a bunch of garbled text? Are there any PHP errors/warnings at the top?