插入MySQL上传查询php

Question

I am trying to make a script to save image link in database like example.com/image.jpg every thing is working fine I just want that if someone enter wrong url like without extension .jpg , .png or .gif it give error to user so they enter correct url

Here is my Php Code

if(isset($_POST['img']));
  $img = $_POST['img'];
  $ti = $_POST['titl'];

  $query = mysqli_query($con,"SELECT * FROM image WHERE url='$img'")

   or die(mysqli_error($con));  
      if(mysqli_num_rows($query) > 0 ) { //check if there is already an entry for that word
        echo "Image already exists! ";
      }
      else {
        mysqli_query($con,"INSERT INTO image (Title, url,) VALUES ('$ti','$img')");
    echo "Image Successfully Added";
 }

And here is html

<form  action="" method="POST" >
  <span>Title:</span>
  <input  type="text" name="titl" maxlength="100" /><br>
  <span>Image URL:</span> 
  <input  type="text" name="img" maxlength="300" />
  <input type="submit" value="Add Image!" id="subm" class="button" />
</form>

Answer 1

$accept = ['.jpg', '.gif', '.png']; // the file extensions you will accept

if (in_array(substr($img, -4), $accept)) // check last 4 chars in $accept
{
    echo "This works";
    // update mysql table
} // if
else
{
    echo "This fails";
} // else

This is just a way to check the file name, not the content of the file. As mentioned by @Fred-ii : The image must still be sanitized for malicious code. One preliminary measure would be to rename the file to something random, and store the random ID in the database. You might also use GD or ImageMagick to copy the file across, 1:1, which would compress the file and remove any malicious code. You can also serve the image from another domain if you have one, to protect your main site and its data.