Insert NULL in mysql (blob) using PHP - php

Question

Ive got the next code
if ($_FILES['intrebare_img']['size'] > 0) {
$tmpName = $_FILES['intrebare_img']['tmp_name'];
$intrebare_img=addslashes(file_get_contents($tmpName));
}
else
$intrebare_img = NULL;
if ($_FILES['opt1_img']['size'] > 0) {
$tmpName = $_FILES['opt1_img']['tmp_name'];
$opt1_img = addslashes(file_get_contents($tmpName));
}
else
$opt1_img = NULL;
if ($_FILES['opt2_img']['size'] > 0) {
$tmpName = $_FILES['opt2_img']['tmp_name'];
$opt2_img = addslashes(file_get_contents($tmpName));
}
else
$opt2_img = NULL;
if ($_FILES['opt3_img']['size'] > 0) {
$tmpName = $_FILES['opt3_img']['tmp_name'];
$opt3_img = addslashes(file_get_contents($tmpName));
}
else
$opt3_img = NULL;
$query = "INSERT INTO intrebari (intrebare_txt, intrebare_img, opt1_txt, opt1_img, opt2_txt, opt2_img, opt3_txt, opt3_img, raspuns_corect)
VALUES ('{$intrebare_txt}','{$intrebare_img}','{$opt1_txt}','{$opt1_img}','{$opt2_txt}','{$opt2_img}','{$opt3_txt}','{$opt3_img}','{$rsp_corect}')";
mysql_query($query) or die("Error, query failed");
When executed it's inserting values in the database, the only issue is that even when there is no file selected it's inserting [BLOB - 0 B] instead of NULL.
I think that my problem is generated by the ' ' around NULL values but can't figure a way around.
Thanks in advance !

Answer 1

The smart thing to do is use PDO or the like along with prepared statements. Let PDO do the heavy lifting and focus your efforts on solving other problems. It would also protect you from SQL injection vulnerabilities, which your code appears to be full of.
If you want to stick with depreciated mysql_ functions, you need to check each variable and remove the quotes from NULL values. Something along the lines of:
if ( $opt3_img !== NULL ) {
$opt3_img = "'".$opt3_img."'";
}
$query = sprintf('INSERT INTO intrebari SET opt3_img = %s', $opt3_img);
You would of course also want to put that functionality into a function to avoid repeating that code for every variable..

Answer 2

In the end, after a little research, I've rewritten the code so it uses PDO.
Here is the result :
$dbh = new PDO('mysql:dbname=dbname;host=127.0.0.1', user, password);
if ($stmt = $dbh->prepare ("INSERT INTO intrebari (intrebare_txt, intrebare_img, opt1_txt, opt1_img, opt2_txt, opt2_img, opt3_txt, opt3_img, raspuns_corect)
VALUES (:intrebare_txt, :intrebare_img, :opt1_txt, :opt1_img, :opt2_txt, :opt2_img, :opt3_txt, :opt3_img, :rsp_corect)"))
{
$stmt -> bindParam(':intrebare_txt', $_POST['intrebare_txt']);
$stmt -> bindParam(':opt1_txt', $_POST['opt1_txt']);
$stmt -> bindParam(':opt2_txt', $_POST['opt2_txt']);
$stmt -> bindParam(':opt3_txt', $_POST['opt3_txt']);
if ( isset ($_POST['rsp_corect']))
$stmt -> bindParam(':rsp_corect',$_POST['rsp_corect']);
else
echo '<script type="text/javascript">alert("Nu a fost selectat un raspuns valid!");window.location=\'intrebari.php\';</script>';
if ($_FILES['intrebare_img']['size'] > 0) {
$tmpName = $_FILES['intrebare_img']['tmp_name'];
$stmt -> bindParam(':intrebare_img', file_get_contents($tmpName));
}
else
$stmt -> bindValue(':intrebare_img', NULL);
if ($_FILES['opt1_img']['size'] > 0) {
$tmpName = $_FILES['opt1_img']['tmp_name'];
$stmt -> bindParam(':opt1_img', file_get_contents($tmpName));
}
else
$stmt -> bindValue(':opt1_img', NULL);
if ($_FILES['opt2_img']['size'] > 0) {
$tmpName = $_FILES['opt2_img']['tmp_name'];
$stmt -> bindParam(':opt2_img', file_get_contents($tmpName));
}
else
$stmt -> bindValue(':opt2_img', NULL);
if ($_FILES['opt3_img']['size'] > 0) {
$tmpName = $_FILES['opt3_img']['tmp_name'];
$stmt -> bindParam(':opt3_img', file_get_contents($tmpName));
}
else
$stmt -> bindValue(':opt3_img', NULL);
$stmt -> execute();
// close connection
$stmt->closeCursor();
$stmt = null;
$dbh = null;
sleep(60);
}
else echo "STM FAILED !!";
}
Due to a misleading answer from another question on this site first I've tried using a mysqli connection obviously that was a fail!
And another thing that I must mention for other people looking at the code is that in `
user and password are defined constants !