php - Store path to uploaded Image in database -


i'm trying add path of uploaded image database in order use display thumbnail post. found tutorial , used code upload image. gets else statement , exit("error while uploading image on server"); have form collect data:

<form action='' method='post' enctype="multipart/form-data">  <p><label>title</label><br /> <input id="title-input" type='text' name='posttitle' value='<?php if(isset($error)){ echo $_post['posttitle'];}?>'></p>  <p><label>description</label><br /> <textarea id="textarea" name='postdesc' cols='20' rows='5'><?php if(isset($error)){ echo $_post['postdesc'];}?></textarea></p>  <p><label>content</label><br /> <textarea name='postcont' cols='20' rows='5'><?php if(isset($error)){ echo $_post['postcont'];}?></textarea></p>  <p><label>image</label><input type="file" name="uploadedimage">                             </p>  <input type='submit' name='submit' value='submit'> <input type='reset' name='submit' value='reset'>  </form> <?php include 'add-post-handler.php' ?>

and here code used upload image:

function getimageextension($imagetype)     {        if(empty($imagetype)) return false;        switch($imagetype)        {            case 'image/bmp': return '.bmp';            case 'image/gif': return '.gif';            case 'image/jpeg': return '.jpg';            case 'image/png': return '.png';            default: return false;        }       }  if (!empty($_files["uploadedimage"]["name"])) {     $file_name=$_files["uploadedimage"]["name"];     $temp_name=$_files["uploadedimage"]["tmp_name"];     $imgtype=$_files["uploadedimage"]["type"];     $ext= getimageextension($imgtype);     $imagename=$_files["uploadedimage"]["name"];     $target_path = "../img/".$imagename;  if(move_uploaded_file($temp_name, $target_path)) {     $query_upload="insert blog_images (imgpath) values ('$target_path')";     mysqli_query($link, $query_upload) or die("error in $query_upload == ----> ".mysql_error());  }else{    exit("error while uploading image on server");  } }

ps: have doubts on how can imageid related postid considering both submitted same form.(i made relation between 2 tables it's on primary keys i'm not sure if it's correct)

thanks help!

looking @ code:

move_uploaded_file returns false on 2 premises (stated in php docs):

if filename not valid upload file, no action occur, , move_uploaded_file() return false.

if filename valid upload file, cannot moved reason, no action occur, , move_uploaded_file() return false. additionally, warning issued.

my best guess is, information provided:

  • your path not writeable application/webserver, won't moved

make sure application (the webserver) can write in path: '../img/' issuing chmod give directory correct rights webserver user.

security advice (not related question):

  1. your application has in state potential sqli in $target_path. should think using prepared statements

  2. your form writes post data directly output. leads xss. should encode special characters in output.

  3. make sure, images can uploaded , scripts can't executed in '../img' path. exploit upload upload script , execute it.

easiest way prevent sqli in case hashing imagename , setting extension $ext variable:

[...] $ext=getimageextension($imgtype); if($ext === false) {     exit("couldn't determine filetype correctly. please upload pictures only."); } $imagename=md5($_files["uploadedimage"]["name"].time()).$ext; $target_path = "../img/".$imagename; [...]

the time() included, can upload pictures same name.


-

Comments

Post a Comment

Popular posts from this blog

scala - 'wrong top statement declaration' when using slick in IntelliJ -

Image
i'm porting project scala 2.9 2.10, therefore have use slick instead of scalaquery. i'm using slick 2.1.0 since supports ms access. according this tutorial , upgrade guide changed robs object class , added val robs : why error message wrong top statement declaration , how rid of it? edit: i'm new scala... according this question seems can't put val outside of methods or classes, right? code above directly in packge. right approach slick then? should move code in class or trait? according this changed val robs = tablequery[robs] to object robs extends tablequery(new robs(_)) {} . no warnings or errors anymore. :)
Read more

c# - DevExpress.Wpf.Grid.InfiniteGridSizeException was unhandled -

Image
when using devexpress, see error: devexpress.wpf.grid.infinitegridsizeexception unhandled message="by default, infinite grid height not allowed since grid rows rendered , hence grid work slowly. fix issue, should place grid container give finite height grid, or should manually specify grid's height or maxheight. note can avoid exception setting gridcontrol.allowinfinitegridsize static property true, in case grid run slowly." the problem dxgrid has infinite height. to fix, set height non-infinite. snoop absolutely invaluable this: if "height" xaml element infinite (i.e. 0 or nan ), can set using one of following: option 1: height="{binding path=actualheight, relativesource={relativesource mode=findancestor, ancestortype=uielement}}" option 2: verticalalignment="stretch" option 3: height="auto" hint: use verticalalignment="stretch" if child of grid <rowdefinition height=
Read more

PySide and Qt Properties: Connecting signals from Python to QML -

i trying run simple pyside appliccation design made in qml. call function in qml python in separated thread. i have following qml view: import qt 4.7 rectangle { visible: true width: 100; height: 100 color: "lightgrey" text { id: datestr objectname: "datestr" x: 10 y: 10 text: "init text" font.pixelsize: 12 function updatedata(text) { datestr.text = qstr(text) console.log("you said: " + text) } } } here application: some imports.... #!/usr/bin/python import sys import time pyside import qtdeclarative, qtcore pyside.qtgui import qapplication pyside.qtdeclarative import qdeclarativeview the qthread worker.... #worker thread class worker(qtcore.qthread): updateprogress = qtcore.signal(int) def __init__(self, child): qtcore.qthread.__init__(self) self.child = child def run(self):
Read more