Question

I am working on a website and my task is to take product image from user and store that image in the database..i am using mysql database.
My code for html form is as:-

      <FORM action="testimage1.php" ENCTYPE="multipart/form-data" method="post">
              <div style="font:bold 10px arial,serif;" >Product Name*</div>
              <input type="text" name="myuserName" maxlength="50" /><br />
             <div style="font:bold 10px arial,serif;" >Upload a photo</div>
               <input name="uploadimage" type="file" /></br>
              <div style="font:bold 10px arial,serif;">Product Description:</div> 
              <input type="text" name="product" value=""></br>
              <input id="submit" type="submit" value="submit" /><br />
     </FORM>

My code for testimage1.php is as:-

           require_once("dbconnect.inc.php");                       
    $db_name="thinstrokes";                                     //for localhost databasename
     $tbl_name="product";
     $db_selected=mysql_select_db("$db_name")or die("cannot select DB");

    $myusername=$_POST['myusername']; 
    $mypassword=$_POST['product'];
    $filename=$_FILES['uploadimage']['tmp_name']; 
    $imgData = file_get_contents($filename);
    $size = getimagesize($filename);
    $sql = "INSERT INTO product
    (productname, image_id , image_type ,image, image_size, image_name,   productdesc)VALUES
    ('$myusername','11', '{$size['mime']}', '{$imgData}', '{$size[3]}', 
     '{$_FILES['userfile']['name']}','$productdesc')";
    $result=mysql_query($sql) or die("error in uploading/*");

and i am getting an error as:-error in uploading/*
how can i correct it?

Answer 1

try to change this:

$sql = "INSERT INTO product
(productname, image_id , image_type ,image, image_size, image_name, productdesc)VALUES
('$myusername','11', '{$size['mime']}', '{$imgData}', '{$size[3]}', 
'{$_FILES['userfile']['name']}','$productdesc')";

with this:

$size_mime = mysql_real_escape_string($size['mime']);
$size3 = mysql_real_escape_string($size[3]);
$filename = mysql_real_escape_string($_FILES['userfile']['name']);
$sql = "INSERT INTO product
(productname, image_id , image_type ,image, image_size, image_name, productdesc) VALUES
('{$myusername}','11', '{$size_mime}', '{$imgData}', '{$size3}', 
'{$filename}','$productdesc')";

and edit this:

$myusername=$_POST['myusername']; 
$mypassword=$_POST['product'];
$filename=$_FILES['uploadimage']['tmp_name'];

with this:

$myusername = mysql_real_escape_string($_POST['myusername']); 
$mypassword = mysql_real_escape_string($_POST['product']);
$filedata = mysql_real_escape_string($_FILES['uploadimage']['tmp_name']);

you should absolutely avoid sql injection!