[RESOLVED] Display Images

akmal1981

Hi guys it's me again !!

I know this topic has been done to death but I unfortunately I am still stuck.

As advised by many, I have stored my images in a folder and save the image names in database (im using XAMPP).

In my database (called a_database) , I have columns called id, Type, Price1, Location, Price and photo. Under the photo column i saved my property photos names which are called image1, image2 and so on.

For your further information, I saved my property photos in the following folder xampp > htdocs > cimb22image .

When I run the html file, unfortunately nothing appeared. Please help a noob here !

akmal.html

<body>
Picture here:<br>
<img src=picscript.php?imname=image1><br>
<!--<img src=\"picscript.php?file={$row["id"]}\">";?><br>-->
</body>
</html>

picscript.php

<?php

$con = mysql_connect('localhost', 'root', ''); 
if (!$con) { 
    die('Could not connect: ' . mysql_error()); 
} 
mysql_select_db("a_database", $con); 

/*$image = stripslashes($_REQUEST[image1]);*/
$id = stripslashes($_REQUEST[id]);  // removes backslashes or clean up data retrieved from db
$id = $_GET['id'];
$result = mysql_query("SELECT photo from a_database WHERE id=$id");

addslashes($image).".jpg\"";
$row = mysql_fetch_assoc($result);
/*$imagebytes = $row[imgdata];*/
$imagebytes = $row[id];
header("Content-type: image/jpeg");
echo $imagebytes;
?>

Any help greatly appreciated.

akmal1981

ermm after a few more readings i got a feeling that i must write full path of my images directory , but just not sure how to ..

bradgrafelman

Several problems with your picscript.php code...

```
$id = stripslashes($_REQUEST[id]);  // removes backslashes or clean up data retrieved from db 
```
The code comment there makes no sense; "clean up data retrieved from db" ? There is no data that has been retrieved from the DB yet.

Furthermore, you shouldn't be calling stripslashes() on incoming data. If such data has backslashes automatically prepended in front of things like single quotes, then you need to get the magic_quotes "feature" disabled in your php.ini file. See the manual page [man]magic_quotes[/man] for all the info you'll ever need about this huge mistake in PHP's history.
Why do you have both of these lines:
```
$id = stripslashes($_REQUEST[id]);  // removes backslashes or clean up data retrieved from db 
$id = $_GET['id']; 
```
when the second is clearly overwriting anything that the first line would have stored in $id?
User-supplied data should never be placed directly into a SQL query string, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors. Instead, you must first sanitize the data such as with a function like [man]mysql_real_escape_string/man (for string data; consider casting numeric data instead) or using prepared statements.
Speaking of prepared statements, note that the [man]mysql[/man] extension is severely outdated and has been superseded for some time now; you should consider replacing it with more updated extensions such as [man]MySQLi[/man] or [man]PDO[/man].
This code:
```
addslashes($image).".jpg\""; 
```
makes no sense for a few reasons:
1. $image is an undefined variable.
2. Even if it were defined, why would you need to use [man]addslashes/man?
3. Why are you trying work with a string that appears to be a filename ending with a double quote?
4. You aren't telling PHP to do anything with that string; it's the same as writing:
```
<?php
true;
?>
```
  or even just:
```
<?php

?>
```
  (in other words, nothing at all).
Before attempting to retrieve data from MySQL, you never check to see if [man]mysql_query/man was successful or that there are any rows in the result set.
This:
```
$imagebytes = $row[id]; 
```
has two problems with it:
1. I doubt you've defined a [man]constant[/man] named id, and since associative array indexes are strings, I'm guessing you mean to use the string 'id' there instead. As such, you're missing quotes around that string value.
2. There will never be an index named 'id' in $row because you aren't SELECT'ing anything named 'id' in your SQL query.
Even if all of the above errors were resolved, how is this script supposed to output binary image data when you never attempt to read any files from the file system? If you are indeed only storing the filename in the database, then I would expect to see some code that looks for the file based on the name stored in the DB and, if found, outputs the file's contents.

akmal1981

world of painnnn !!!!!!!!! thanks for the help , i'll be looking at the comments

akmal1981

hey guys I have super noob question

$directory = '/path/to/directory';

how path to directory looks like ? If i have photos in xampp > htdocs > cimb22image , do I write '/htdocs/cimb22image'; ? 😕

akmal1981

pls ignore the post before !

niroshan

HI akmal1981,

Since your storing all the images in the file system, why are you using a separate file to read the files and output? Let browser handle that.

all you need is just 1 php file.

Since your not sure about the actual location of the image files,

check the location from your main PHP file first
```
echo $_SERVER['DOCUMENT_ROOT'];
```
This will give you the actual location of the PHP file.
now check wheres your image files resides based on this URL

so if your PHP file location is given as, xampp/htdocs/ and your images files resides in xampp/htdocs/cimb22image the the path for the image you should specify is,

'cimb22image/'.imagename

$_SERVER['DOCUMENT_ROOT'].'/cimb22image/'.imagename

One other thing I have to mention is that your database design is not good. Assume you have more than 1 image for a property? Please read about database normalization. Its better to have a separate table for all the images and link that table with property table using primary key / foreign key.

As for your example here is the simple way,

//Do the connection. Please take bradgrafelman advice on this

//I hope there`s only 1 image for property :)
//Do all the necessary cleaning for the user data
$result = mysql_query("SELECT photo from a_database WHERE id=$id"); 

//first check mysql_num_rows() to check whether there`s any records or not

$row = mysql_fetch_assoc($result); 

//Assume your cimb22image folder is in the root
echo '<img src="'.$_SERVER['DOCUMENT_ROOT'].'/cimb22image/'.$row['photo '].'">';

Thanks,
Best regards,
Niroshan

akmal1981

thanks Niro ,

Also, I'd like to share another solution . The code is working but being a noob i wouldnt know whether there is any shortcomings which i could not see . Basically I added to my existing code in 'sexy girl hyperlink' thread earlier.

<?php 
$con = mysql_connect('localhost', 'root', ''); 
if (!$con) { 
    die('Could not connect: ' . mysql_error()); 
} 
mysql_select_db("a_database", $con); 




$db_name="a_database"; 
$tbl_name="property"; 

// Connect to server and select database. 

//mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
//mysql_select_db("$db_name")or die("cannot select DB"); 

$member_id = $_GET['id']; 
$results = mysql_query("select * from property where id = $member_id"); 
$row = mysql_fetch_assoc($results); 

?> 
<html> 
<head> 
    <link href="style.css" type="text/css" rel="stylesheet"> 
</head> 
<body> 

<div align="center"> 
<table width="90%" cellpadding="0" cellspacing="0" border="0"> 

<tr> 
	<?php echo "<td>" . $row['Price1'] . "</td>"; ?>
</tr> 

</table> 
<img src = <?php echo "images/".$row['photo'].".jpg width='150' "; ?> border="0" />
   <?php echo "<td>" . $row['photo'] . "</td>"; ?>

</div> 
</body> 
</html>

Thank you very much to both Brad and you (and many others too) !!! Still have so much to learn / to do .... about security which Brad mentions about , SQL injections and whatever else I dont know and the worst thing is not knowing what i dont know haha I would like to sit down and go through line by line one day and really try to understand the synthax , but because of dateline i had to resort to copy and paste and lots of trial and errors . No more excuse after that haha

akmal1981

@ Niro , the code above would cater many images.

If no further comments from the experts here , i will close the thread tomorrow . Hopefully there are still useful inputs.

niroshan

Hi akmal1981,

What do you mean by,

the code above would cater many images

You mean 1 property have many images? If that`s the case then you need a separate table to hold all the related images and link them through Primary key / foreign key as I suggested before.

Ps. My advise is not to close the thread, if you don`t got a possible solution or an hint. But Its up to you

Regards,
Niroshan

akmal1981

Hi Niro , yes I have database for the images. It is more like this : under the photo column db, there are file names of the photos example : image1.jpg image2.jpg etc and the primary link is the id number column. I saved the images in other folder called image folder.

If i click first row of the table, I will have further information of the property A in new window (example of further information are property photo , full property address etc) . That is what the code above has done (from my previous 'sexy girl hyperlink' thread').

The same with property B , C and so forth when i click the respective rows.

So happy ! now i need to put things together so im pretty sure there will be new thread from me again haha many thanks and still looking forward for any input for this thread 🙂