How can I enter an image into mysqli? [duplicate] - php

Question

This question already has answers here:
Empty values being added to all mysql rows instead of just the target row
(2 answers)
Closed 6 years ago.
I am not so sure how to process an image in PHP to put it into a blob type in MYSQLI. Here is my code so far...
<?php
$servername = ""; //Taken out for stack overflow question
$username = ""; //Taken out for stack overflow question
$password = ""; //Taken out for stack overflow question
$dbname = ""; //Taken out for stack overflow question
$conn = mysqli_connect($servername, $username, $password, $dbname);
if (!$conn)
{
echo 'Could not connect';
}
else
{
if (!empty($_FILES['cf'] && $_POST['category']))
{
$file = $conn->real_escape_string($_FILES['cf']['tmp_name']);
mysqli_query($conn, "INSERT INTO adDatabase(".$category.") VALUES(".$file.")");
}
else
{
echo 'Empty file';
}
}
mysqli_close($conn);
?>
Now the value of the image is not null so the image is processed. But I cant seem to get it processed. Normally I make a variable $var = $_POST['cf']; then I add that into the query. I also tried $var = $_FILES['cf']; but it wont process. Is there something else I need to do to it to make it send/process properly?
Edit based on answer
I changed my PHP to something that resembles an answer
<?php
$servername = ""; //Taken out for stack overflow question
$username = ""; //Taken out for stack overflow question
$password = ""; //Taken out for stack overflow question
$dbname = ""; //Taken out for stack overflow question
$conn = mysqli_connect($servername, $username, $password, $dbname);
if (!$conn)
{
echo 'Could not connect';
}
else
{
if (!empty($_FILES['cf'] && $_POST['category']))
{
try
{
$file = $conn->real_escape_string($_FILES['cf']['tmp_name']);
$filecontents = File_Get_Contents($file);
$filecontentssafe = $conn->real_escape_string($filecontents);
mysqli_query($conn, "INSERT INTO adDatabase(".$category.") VALUES(".$file.")");
echo 'Query successful';
}
catch(Exception $e)
{
echo 'Could not perform action' + $e;
}
}
else
{
echo 'Empty file';
}
}
mysqli_close($conn);
?>
Now I see Query successful, however.. nothing goes into the database.
Edit - added retrieve file
<?php
$servername = "";
$username = "";
$passcode = "";
$dbname = "";
$conn = mysqli_connect($servername, $username, $passcode, $dbname);
if (!$conn)
{
echo 'Could not connect';
}
else
{
try
{
$sql_query = mysqli_query($conn, "SELECT * FROM `adDatabase`");
while ($row = mysqli_fetch_array($sql_query))
{
$id = $row['ID'];
$img = $row['img'];
$image = '<img src="data:image/png;base64,'.base64_encode( $row['food'] ).'" style="height: 12em; width: 12em; margin: 1em; padding: 0.9em; " >';
echo $image;
}
}
catch(Exception $e)
{
echo $e;
}
}
?>
How I retrieve information

Answer 1

By the time you call mysql, $file only contains a path to the temporary uploaded file, not the data you want.
If you want MySQL to look at the file's path, and load its contents directly into your database, have a look at the MySQL function LOAD_FILE() here: http://dev.mysql.com/doc/refman/5.7/en/string-functions.html#function_load-file
Otherwise, if you'd like to do this in PHP, you'd want to pull the file's contents into a variable with something like
$file_contents=File_Get_Contents($file);
... and then use
$file_contents_safe=$conn->real_escape_string($file_contents);
before sticking $file_contents_safe into the database. Some people also like to Base64 encode.
Edit: Please also keep injection vulnerabilities in mind, as others have suggested. The name of the temporary file, and anything else coming in from post/apache shouldn't be trusted on its own.

Answer 2

If you don't have to stick with saving the blob content in the database, you could only save the file name in the database and do a regular file upload to a selected location. For that, you will need to add this before adding the content in the database
$tmp_name = $_FILES["filename"]["tmp_name"];
$name = $_FILES["filename"]["name"];
move_uploaded_file($tmp_name, "YOUR_UPLOAD_DIR/{$name}");
And after uploading the file, you just need to store it's name in the database instead of storing the blob content. When displaying, you just need to access the actual file in your upload folder and show it. It's much cleaner solution, especially if you don't have to migrate files between servers.
The whole code would look something like this:
if (!empty($_FILES['cf'] && $_POST['category']))
{
$tmp_name = $_FILES["cf"]["tmp_name"];
$name = $_FILES["cf"]["name"];
move_uploaded_file($tmp_name, "YOUR_UPLOAD_DIR/{$name}");
$file = $conn->real_escape_string($name);
mysqli_query($conn, "INSERT INTO adDatabase(".$category.") VALUES(".$file.")");
}
Then when accessing it, you will need to pull the data from the database and just display it. If it is an image, it could be
<img src="<?php YOUR_UPLOAD_DIR.'/'.$name ?>"/>
Otherwise:
To insert the image data in your database do:
$content = file_get_contents($tmpName);
$file = $conn->real_escape_string($content);
$mime_type = mime_content_type($tmpName);
mysqli_query($conn, "INSERT INTO adDatabase(".$category.", mime_type) VALUES(".$file.", ".$mime_type.")");
Note I added a mimetype to the insert, because you will need it in order to be able to display the file properly later.
Then, when you want to display it, just pull the content from the db and echo it together with the proper header.
header('Content-type:'.$mime_type);
echo $content;