Question

I’m having an issue using a watermarking script I have. Below is the script:

if (isset($_GET['imgid'])) {
    include "../mysql_connect.php";
    $imgid = $_GET['imgid'];
    $query = "SELECT * FROM img_ref WHERE id='$imgid'";
    $result = mysql_query($query) or die(mysql_error());
    $row = mysql_fetch_array($result);
    $imagesource = "../ajax_uploads/$row[submitter_id]-uploads/$row[filename]";
} else {        
    $imagesource =  "../ajax_uploads/" . $_GET['path'];
}
$info = pathinfo($imagesource); 
$filetype = $info['extension']; 
if($filetype == "gif")  $image = @imagecreatefromgif($imagesource);  
if($filetype == "jpg")  $image = @imagecreatefromjpeg($imagesource);  
if($filetype == "png")  $image = @imagecreatefrompng($imagesource);  
if (!$image) die(); 
$watermark = @imagecreatefrompng('../images/watermark.png');
// This is the key. Without ImageAlphaBlending on, the PNG won't render correctly.
imagealphablending($image, true);
$imagewidth = imagesx($image); 
$imageheight = imagesy($image);  
$watermarkwidth =  imagesx($watermark); 
$watermarkheight =  imagesy($watermark); 
$startwidth = (($imagewidth - $watermarkwidth)/2); 
$startheight = (($imageheight - $watermarkheight)/2); 
imagecopy($image, $watermark,  $startwidth, $startheight, 0, 0, $watermarkwidth, $watermarkheight); 
imagejpeg($image);
imagedestroy($image); 
imagedestroy($watermark); 

Now, if I pass a ‘path’ variable through, everything works fine and the image is displayed correctly as I would imagine. However, when I attempt to pass through an imgid value, and retrieve the path from the database, the image is presented in raw data on the screen – not as an image.

I have tried specifying the headers

header("Content-type: image/jpeg");

However that hasn’t helped. It doesn’t seem to be an issue with the folder permissions, as if I specify the path name using the reference in the database, it works fine. It seems to be that including that first “if” section seems to break the output, and I’m at a loss why.

Could anyone possibly shed any light on this for me?

Thank you kindly,

Dan

UPDATE

Okay, somehow its started working with having “Header(“Content-type: image/jpeg”);” placed at the top of the PHP file, so if I go to the file directly and put in the GET id, I get the picture returned – which is good (no idea what changed though).

However I still have an issue in displaying this picture elsewhere it seems. I’m calling the picture using “fancybox”, a jquery plugin. When it displays the image, it is still showing the raw data. If I use the path, it displays fine – just for some reason the raw data shows up when using the GET id option. Am still looking into it but thanks for suggestions so far.

Answer 1

It seems using the header

header("Content-type: image/jpeg");

Seemed to work to get it to display as an image – however it did not work with fancybox for some reason. I looked at the API and have sinced forced fancybox to realise it is an image:

$.fancybox({
            'href':'processes/process_watermark.php?imgid=' + id,
            'type':'image'
        });

That makes it display correctly.

Thanks for everyones help – and all the comments reminding me about SQL attacks.