Question

Hello i would like to make sure I get this code right, and I am really not sure of the syntax.

Here is the situation. I am scanning a directory and echoing its contents as img tags and thumbnails. I also want to match each image up with descriptions and titles which are stored in a table. (‘id’, ‘name’, ‘title’, ‘description’)

The name of each file in the directory was created with a user generated value, stored as ‘name’ in the that same table. I want to match each title and description with the file name, and place them in the appropriate place in my img tag and link.

here is the code:

<?php
$connect = mysql_connect ("localhost","root","") or die("couldn't connect :(");
mysql_select_db("cynthieimages") or die("couln't find db :(");

*here I want to pull the data from the table into an $data[]

$handle = opendir(dirname(realpath(__FILE__)).'/images/fullscreen/graphicdesign/logos');
while($file = readdir($handle))
  {
     if($file !== '.' && $file !== '..')
        {

        *Right in here I need to define $title by exploding $file and geting the first part of the name*
        *Here i want to define $description from $data[] where it shares a row name as $title* 

echo '<a href="images/fullscreen/graphicdesign/logos/'.$file.'" rel="prettyPhoto[pp_gal]" title="'.$description.'"><img src="images/thumbnails/websitethumbs/graphicdesign/logos/th_'.$file.'" width="60" height="60" alt="'.$title.'" /></a>';

       }
   }
?>

Anyway, that is my thought process… I am not even sure if it will work. Please, you masters of PHP, come to my aid 😉

Answer 1

Looking up a DB with input from the user (file names in the filesystem are also user input) is is risky and prone to security issues. Make sure to properly use mysql_real_escape_string if you use mysql, or use an equivalent technology on other DB’s.

But all the better, stick with Eugen Rieck’s answer. Save all meta data in your DB and pull everything from your DB and only save your raw image on file.