output image (mysql, PHP) [duplicate] - php

Question

This question already has an answer here:
Difference in accessing arrays in PHP 5.3 and 5.4 or some configuration mismatch?
(1 answer)
Closed 6 years ago.
I a, trying output photo, but can't.
when i write this
echo "<p>Name: <b>".$rows['photo']."</b></p>";
it say:
img/car.jpg
but i need a image, so I write
echo '<p><img src=img/$rows['photo']/></b></p>';
it say
Parse error: syntax error, unexpected T_STRING, expecting ',' or ';'

Answer 1

Try this:
echo "<p><img src=img/$rows['photo']/></b></p>";
or
echo '<p><img src=img/'.$rows['photo'].'/></b></p>';

Answer 2

This is correct string manipulation to get what you want:
echo "<p><img src=\"{$rows['photo']}\" /></p>";
Use "" as string wrapper to inject variables using curly braces notation.
Also if you have $rows['photo'] = img/car.jpg you will not need extra img/ in src attribute.
And i removed </b> tag, since there was no opening tag for it.

Answer 3

if you want to display the image fetch the image in the separate file and use that file path in the img tag
<img src="fetch_image.php?id='.$id.'"/>
$id is a primary key value

Answer 4

The fail is caused by the bad syntax. If we can assume that $rows['photo'] holds a filename within /img directory then you should use it like this:
double quotes here and at the end
↓
echo "<p><img src='img/{$rows['photo']}'/></b></p>";
↑ ↑
curly braces to distinguish variables in a string
Here's a manual that you need to read in order to understand how it works http://php.net/manual/en/language.types.string.php
And last but not least - you have a possible XSS attack vector here because you don't escape value of $rows['photo']. That means that if a value of photo can be changed by user then user could put, for example this string: image.jpg' onclick='window.location="my.fishing.website.com"; - that is being the most simple form of this kind of attack (he could also steal cookie values or any other sensitive data).
To mitigate this kind of security hole you need to escape values, which can be influenced by user in any way, with htmlspecialchars() function. Or even better use templating engine that would it for you: http://www.phptherightway.com/#templating