Need Help inserting / retrieving images from MySQL Database

phpnewbie34

Good morning programmers,

How do you insert an image name into a MySQL database?

For example - car.jpeg, bike.png

What is the code for storing a name with a decimal (.) in it?

Do I use blob, longblob, varchar?

Any suggestions would be great 🙂

bradgrafelman

phpnewbie34;11026913 wrote:
How do you insert an image name into a MySQL database?

For example - car.jpeg, bike.png

What is the code for storing a name with a decimal (.) in it?

It would be the same as if you were storing any other string. The fact that the string contains a period has no bearing on the SQL query syntax.

phpnewbie34;11026913 wrote:
Do I use blob, longblob, varchar?

You should use whichever type is most appropriate/efficient to store the data. (If it's a very short string, like the name of a file, I would guess that VARCHAR is going to be the wisest choice.)

phpnewbie34

I appreciate your response.

What I'm trying to do now is retrieve the image from $_FILES, switch the directory, then store the name in a variable, then send it to MySQL.

Basically - the user uploads an image on one page, you get directed to another, the pages says "1 pictured added to DB", and the picture is resaved to my folder with the name stored in my MySQL

The code for my welcome page is

$destination='C:\xampp\htdocs\PHPProject1\\'."\\".$_FILES['pix']['name'];
$temp_file= $_FILES['pix']['tmp_name'];
move_uploaded_file($temp_file, $destination);
$img= $_FILES['pix']['name'];

$con=mysqli_connect("***","***","***","test");
// Check connection
if (mysqli_connect_errno())
  {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
  }

mysqli_query($con,"INSERT INTO pix (ID,Name, type)
VALUES (null, $img, null)");

NogDog

You will need single quotes around the variable name in the VALUES() clause. However, you also need to sanitize it against SQL injection errors/attacks. Best way is to make use of MySQLi prepared statements and bound parameters (in which case you would not need to add the single quotes). Secondary option would be to manually escape it.

bradgrafelman

Some secondary issues with the code you posted above that should be considered at some point:

Consider applying something like [man]basename/man to the 'name' parameter to prevent malicious users from submitting file names like '../../foo.php' that contain relative paths.
You never check to see if the file upload was actually successful before attempting to process it; see [man]features.file-uploads.errors[/man].
You never check to see if the call to [man]move_uploaded_file/man was successful.
You never check to see if the SQL query was executed successfully.

phpnewbie34

What is the code for that?

How do I make sure I don't upload the same thing twice?

I really appreciate the help