Php issues with file_get_contents

Question

I am having trouble uploading an image into my database. Now the form send and processes successfully however it does not properly send when I put the variable containing the file_get_contents information. So here is my code so far.

<?php
    if (isset($_POST['submit-ads']))
    {
        $filename = $_FILES["file_uploaded"]["name"];
        $filecontent = $_FILES["file_uploaded"]["tmp_name"];
        $filesize = $_FILES["file_uploaded"]["size"];
        $filetype = $_FILES["file_uploaded"]["type"];
        if ($filetype == "image/png" || "image/jpeg" || "image/bmp")
        {
            if ($filesize > 0 && $filesize < 1000000000)
            {
                if ($newContent = file_get_contents($filecontent))
                {
                    if ($conn = mysqli_connect("localhost", "root", "", "smartlea_browser_extensions"))
                    {
                        $newQuery = "INSERT INTO `food`(`image`, `imagename`, `access_token`) VALUES('".$newContent."', '".$filename."', '123')";
                        if ($query = mysqli_query($conn, $newQuery))
                        {
                            echo 'Works erase this line';
                        }
                        else 
                        {
                            die("Could not insert file".mysqli_error($conn));
                        }
                    }
                    else 
                    {
                        die('Could not connect to mysql');
                    }
                }
                else 
                {
                    die('ERROR getting file content. Invalid filepath');
                }
            }
            else 
            {
                die('Invalid filesize');
            }
        }
        else 
        {
            die('Image type not supported');
        }
    }
?>

Now this does not work. Again the issue lies on the line performing the query. When I put $newContent into the field. It throws this error

Could not insert fileYou have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'P�$�>�̒��(j�d�nf���  5I�O7������$٧�Y�sqEM���' at line 1

Can someone shed some light on why this is not working? What I am trying to do is just upload an image into my database. Please do not recommend saving it into a folder because there is a strict reason I am doing it this way. Now no ajax is involved. Just that PHP code (Which is a snippet but everything involved in that function) The error is above if you need any other information let me know.

You're trying to send binary data through a text-based protocol. — tkausl, Sep 02 '16 at 20:24
$newQuery = "INSERT INTO food (image, imagename, access_token) VALUES('".$newContent."', '".$filename."', '123')"; — Alive to die - Anant, Sep 02 '16 at 20:26
First off, [read this](http://stackoverflow.com/questions/3748/storing-images-in-db-yea-or-nay) as to whether you should store images in a database. Second, if you still want to store images in a database, you should be using a binary column ("blob") and binding the image data with [send_long_data](http://php.net/manual/en/mysqli-stmt.send-long-data.php). — Jonathan Kuhn, Sep 02 '16 at 20:32
@user6750159 They mean that you are just doing string concatenation (which is just text) with binary data (which is not text). You need to use another method to pass along the binary data so it isn't interpreted as text. — Jonathan Kuhn, Sep 02 '16 at 20:35

score 3 · Accepted Answer · edited Sep 02 '16 at 20:47

3

You need to use the function mysqli_real_escape_string to make sure your file contents doesn't break your sql query. Like so:

$newContent = mysqli_real_escape_string($conn, $newContent);
// Now run the query

Even better, use prepared statements, read more on this here.

edited Sep 02 '16 at 20:47

Andrew LaPrise

3,373
4
32
50

answered Sep 02 '16 at 20:33

MarcHoH

340
1
6

score 0 · Answer 2 · answered Sep 02 '16 at 20:32

0

Please be very careful with these types of INSERT queries. You are vulnerable to SQL Injection attacks like these. The error you are getting is a red flag for these types of attacks. The data you are inserting in your query contains characters that are not supported.

Change the column image to type LONGBLOB. And please read up on SQL Injection vulnerabilities. At least sanitize your input or use Parameterized Queries

answered Sep 02 '16 at 20:32

Jurriaan

71
7

So you think its because its not longblob? Let me go check my database be right back. – Ignatius Sep 02 '16 at 20:35
No. Not entirely. However storing images should be in a `LONGBLOB`. The issue is that you are appending characters to your query that are not recognised by MySQL. Because they are the file content (IIRC this is base 64) – Jurriaan Sep 02 '16 at 20:40
Alright. I'm assuming that after escaping that it works now. This however still does NOT fix the SQL Injection vulnerability in your query. Good to hear it works! – Jurriaan Sep 02 '16 at 20:44

score -1 · Answer 3 · answered Sep 02 '16 at 20:27

-1

Change your image type in your database to varchar and save the path of image in your database. You can also move the uploaded file in destination path with move_uploaded_file() method.

http://php.net/manual/fr/features.file-upload.php

answered Sep 02 '16 at 20:27

Kevin Grosgojat

1,386
8
13

I need to use blob. My retrieve method fetches a blob type then uses base64 encoding – Ignatius Sep 02 '16 at 20:33
Who marked this down? This is not a bad answer. Logical but my program just doesnt call for it. – Ignatius Sep 02 '16 at 20:35
1

@user6750159 but it doesn't do anything to help solve the question. It offers a suggestion to change your application rather than solving the issue at hand. It would be better suited as a comment or suggestion than an answer. (also, not me) – Jonathan Kuhn Sep 02 '16 at 20:37

Php issues with file_get_contents

3 Answers3