PHP Tutorials: Uploading/Storing an Image inside a MySQL Database (Part 2)
Posted on 13 July 2010 by Abidoon
Categorized | MySQL
21 Responses to “PHP Tutorials: Uploading/Storing an Image inside a MySQL Database (Part 2)”
Leave a Reply
- Yellow Dog Linux 6.1- PS3: how to download, burn and install part2
- Exploring MythTV and mediaMVP
- PHP Tutorials: Create a Search Engine (Part 1)
- Fedora 11 Installation
- PHP Tutorial: Installation and The Basics
- Brian Boatright: Please tell me there will be a version of 2.0 t...
- Stewart Smith: While we’re not planning it for our 2.0.0...
- Brian Boatright: I only have one MySQL server and have been cons...
- Drizzle Day 2012 | Ramblings: [...] Day 2012 Henrik has already posted it ov...
- Dave Juntgen: Baron – This “feature” has be...
Categories
Archives
- February 2012
- January 2012
- December 2011
- November 2011
- October 2011
- June 2011
- May 2011
- April 2011
- March 2011
- February 2011
- January 2011
- December 2010
- November 2010
- October 2010
- September 2010
- August 2010
- July 2010
- June 2010
- May 2010
- April 2010
- March 2010
- February 2010
- October 2008
- September 2008
- March 2006
@ti07shadow Yes, but addslashes has no idea what char set you use and can then be tricked into a sql injection, it also permanently adds the slashes which will force you to strip them.
And since they basically do the same thing mysql_real_escape suffers from the same problem and can be bypassed if your MySQL server or application doesn’t properly specify the char set to use(There is a function to do it, don’t use a SET NAMES query it won’t work), which a lot of people don’t.
@Myztik7 wel mysql_real_escape_string basically does the same thing as addslashes, its just more efficient than addslashes.
addslashes is for single-byte strings whilst mysql_real_escape_string is recommended for multi-byte strings.
… and it wooorks…
lol
@Myztik7
I agree with you, but PDO is not a good option for multi queries, only single queries.
There is also alot more work involved in say binding arrays. Some web hosts still use php4 so mysql is the only option for some.
My only real concern with this tutorial is there is no security against shell commands
@Hydrolics82
mysql_real_escape_string is much better, but like I said earlier, mysql_* functions are all old and still using them is pretty silly.. You should at least move up to the mysqli_* functions, or even better, use PDO.
And since mysqli and PDO isn’t ancient like mysql_* they support Prepared Statements which will let you separate the query and the data, that way the input data can’t modify the query and you get no sql injections.
Its about time!!!
@Myztik7
I agree real_escape_string will automatically addslashes then you would need to stripslashes when displaying. Images inside a database is also not really a good idea.
this is very good video!Thank’”s!!!
Thanks Alex for another really useful tutorial. This one had stumped me for ages!
Your tutorials should have so much more views, there that good
Probably using base64 makes the content 30% shorter
@phpacademy Hello, Alex. i have a question : What are the vid dimentions? (Bad English ;// ) is : 320×240 ? or what? (Sorry for my really bad english)
@phpacademy Yes, I did notice. The thing is, a PHP script isn’t all about functionality, but also about security. And nothing forbidden you to use the right functions.
Would have took a few less seconds even, because you edited your function twice. 
@Morcous16 No it wouldn’t work, for a simple reason, the file will not be processed as an image but only as a standard PHP text file, which will only echo out some huge and strange string.
@phpacademy Will it still work without the header if you had refreshed your cache? Just wondering.
Thanks for a great tut Alex
@francismori7 I do mention in the tutorial it ‘somewhat’ protects. I’m focusing on the functionality in this tutorial, rather than security.
Yeah, in regards to Myztik7, I’d recommend the use of mysql_real_escape which secures the string for MySQL input.
@Myztik7 It was a highly requested tutorial. Thanks for your input anyway.
Storing files in the database is slower and not really a good idea.
Also,
The mysql functions are pretty much deprecated and should not be used.
$_REQUEST is bad practice and should not be used unless you have a really good reason.
Using addslashes() is dumb and insecure.
Pssssssst, ever heard of the browser cache?
@francismori7 Thanks for letting me (and other viewers) know!
You’re right, it will not work without the header. For some reasons, the page shown after the upload somehow got cached by your browser, which might be the reason. But without using the header replacement, there’s no way it can work of course. Well, it could if the IMG tags from HTML processes them as such. I seriously doubt it though.