尝试在MySql表中插入图像时PHP抛出错误？

Question

I am trying to save an image in the MySql table with the data type as BLOB. However i get an error when it tries to insert in the MySql table ? Can someone explain what is wrong ? Below is line 37

mysqli_query($con,"INSERT INTO image (image) VALUES ($_FILES['file']['tmp_name']) ");

Error

 Parse error: syntax error, unexpected '' (T_ENCAPSED_AND_WHITESPACE), expecting identifier (T_STRING) or variable (T_VARIABLE) or number (T_NUM_STRING) in C:\wamp\www\FileUpload\php\upload_file.php on line 37

HTML

<form action="php/upload_file.php" method="post" data-ajax="false" enctype="multipart/form-data">
 <label for="file">Filename:</label>
 <input type="file" name="file" id="file"><br>
 <input type="submit" name="submit" value="Submit">
</form>

PHP

<?php

$con=mysqli_connect("localhost","root","root123","deal_bank","3306");

if (mysqli_connect_errno())
  {
        echo "Failed to connect to MySQL: " . mysqli_connect_error();
  }

mysqli_select_db($con,"deal_bank");

$allowedExts = array("gif", "jpeg", "jpg", "png");
$temp = explode(".", $_FILES["file"]["name"]);
$extension = end($temp);

if ((($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/jpg")
|| ($_FILES["file"]["type"] == "image/pjpeg")
|| ($_FILES["file"]["type"] == "image/x-png")
|| ($_FILES["file"]["type"] == "image/png"))
&& ($_FILES["file"]["size"] > 20000)
&& in_array($extension, $allowedExts)) {
  if ($_FILES["file"]["error"] > 0) {
    echo "Return Code: " . $_FILES["file"]["error"] . "<br>";
  } else {
    echo "Upload: " . $_FILES["file"]["name"] . "<br>";
    echo "Type: " . $_FILES["file"]["type"] . "<br>";
    echo "Size: " . ($_FILES["file"]["size"] / 1024) . " kB<br>";
    echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br>";
    if (file_exists("upload/" . $_FILES["file"]["name"])) {
      echo $_FILES["file"]["name"] . " already exists. ";
    } else {
      move_uploaded_file($_FILES["file"]["tmp_name"],
      "upload/" . $_FILES["file"]["name"]);
      echo "Stored in: " . "upload/" . $_FILES["file"]["name"];
      mysqli_query($con,"INSERT INTO image (image) VALUES ($_FILES['file']['tmp_name']) ");

    }
  }
} else {
  echo "Invalid file";
}

?>

MySQL Table

CREATE TABLE `image` (
  `image` blob
) ENGINE=InnoDB DEFAULT CHARSET=latin1;

Answer 1

Here is the preferred way to do it using mysqli:

$stmt = $con->prepare('INSERT INTO image (image) VALUES (?)');

$null = null;
$stmt->bind_param('b', $null);
$stmt->send_long_data(0, file_get_contents($_FILES['file']['tmp_name']));

$stmt->execute();