使用php将图像上传到数据库[关闭]

Question

I want to upload images to a database where the image will only echo out if it is by the user but it doesn't work and it doesn't give me any errors

<?php

session_start();

    $pic = $_FILES['pic'];
    $submit = $_POST['post'];
    $user = $_SESSION['username'];

    if($submit){
        $connect = mysql_connect("localhost", "root", "123");
        if($connect){
            $database = mysql_select_db("phplogin");
            if($database){
                mysql_query("INSERT INTO images(image, user) VALUES ($pic, $user)");
                $query = mysql_query("SELECT * FROM images WHERE user = '$user'");
                $data2 = mysql_fetch_array($query);
                header("Content-type: image/jpeg");
                echo $data2['image'];
            } else {
                die("Couldn't connect to the database please try again, if you fail to connect again please contact me");
            }
        } else {
            die("Couldn't connect to the database please try again, if you fail to connect again please contact me");
        }
    }



?>

Answer 1

You need to get the file's contents first then insert them into the database. Also your query does not close the variables off in single quotes.

//Need to get contents then escape any characters that match
//mysql query elements like quotes etc.
$contents = mysql_real_escape_string( file_get_contents($_FILES['pic']['tmp_name']) );
$result = mysql_query("INSERT INTO images(image, user) VALUES ('$contents', '$user')");
if($result === FALSE){
   //insert failed echo error and die
   echo mysql_error();
   die;
}
$query = mysql_query("SELECT * FROM images WHERE user = '$user'");
$data2 = mysql_fetch_array($query);
header("Content-type: image/jpeg");
echo $data2['image'];

Note that you should be using mysqli and prepared statements instead. mysql_* and the mysql class are depreciated, and using prepared statements are better for preventing injection attacks.