Question

I’m trying to make a database that uploads the pictures and shows them, sorta like a gallery. It uploads them but the problem is where the pictures should be it gives me this strange symbol ( sorry can’t post it because I’m new 😐 ) and I can’t tell if this means it just refuses to show them, or something went wrong. Help?

<?php
    mysql_connect("localhost") or die(mysql_error());
    mysql_select_db("images") or die(mysql_error());

    $id=addslashes($_REQUEST['id']);
    $image=mysql_query("SELECT * FROM dadsda WHERE id=$id");
    $image=mysql_fetch_assoc($image);
    $image=$image['image'];

    header("Content-type: image/jpeg");

    print($image);
?>

Answer 1

At no point in that code is the image actually output.

If image is a BLOB field in the database, you’d need to do print $image; after the header() call. If it’s a filename/path, you’d need to use readfile() to output the contents of that file.

Also, this code is vulnerable to SQL injection. If I go to script.php?id=1%3B+DROP+TABLE+dadsda%3B it’ll delete your database table because I just made your code execute the SQL query SELECT * FROM dadsda WHERE id=1; DROP TABLE dadsa;.