Question

I am currently storing in MySQL database image names for easier way to retrieve the actual images. I am having problems with the php code I created that stores the names. Duplicate and blank insertions are being made into the DB without my permission.

Is there a way to avoid this issue of duplicate or blank values being inserted when the page refreshed?

<?
$images = explode(',', $_GET['i']);

$path = Configuration::getUploadUrlPath('medium', 'target');


if (is_array($images)) {
    try {
        $objDb = new PDO("mysql:host=" . $host . ";dbname=" . $db, $user, $pass);
        $objDb->exec('SET CHARACTER SET utf8');
    } catch (PDOException $e) {
        echo 'There was a problem';
    }

    $sql = "INSERT INTO `urlImage` (`image_name`) VALUES ";

    foreach ($images as $image) {
        $value[] = "('" . $image . "')"; // collect imagenames
    }

    $sql .= implode(',', $value) . ";"; //build query
    $objDb->query($sql);
}

?>

Answer 1

I reformatted things into what I think should be slightly more readable and more easily separate what’s going on in the code. I also updated your queries to show how you can properly “sanitize” your input.

I still think the process by which you’re going about sending the data to the server is wrong, but hopefully this code helps you out a little bit. I’d also do this more object orientedly.. but I feel that leaves the scope of your question just a little bit =P. It’s kind of like everyone else is saying though, the logic for your code was only off just slightly.

As for the duplication thing, look into checking if the file already exists before adding it to the database.

<?php
$_GET['i'] = 'file1.png, file2.png, file3.png'; // This is just for testing ;].

$images = retrieve_images();
insert_images_into_database($images);

function retrieve_images()
{
    //As someone else pointed out, you do not want to use GET for this and instead want to use POST. But my goal here is to clean up your code
    //and make it work :].

    $images = explode(',', $_GET['i']);
    return $images;
}

function insert_images_into_database($images)
{
    if(!$images)//There were no images to return
        return false;

    $pdo = get_database_connection();

    foreach($images as $image)
    {
        $sql = "INSERT INTO `urlImage` (`image_name`) VALUES ( ? )";
        $prepared = $pdo->prepare($sql);
        $prepared->execute(array($image));
    }
}

function get_database_connection()
{
    $host = 'localhost';
    $db = 'test';
    $user = 'root';
    $pass = '';
    try {
        $pdo = new PDO("mysql:host=" . $host . ";dbname=" . $db, $user, $pass);
        $pdo->exec('SET CHARACTER SET utf8');

        } catch(PDOException $e) {
            die('There was a problem');
        }

    return $pdo;
}