Question

When I run this code, and $testpage is an alphameric string, it is uploaded perfectly. However, when $testpage is defined using file_get_contents(…), it does not upload at all.

<?
...
...

mysql_connect(localhost,$username,$password);
mysql_select_db($database) or die("Unable to select database");


$testpage = file_get_contents('http://us3.php.net/manual/en/function.file-get-contents.php');

$testpage = mysql_real_escape_string($testpage);
mysql_query("INSERT INTO theTable(Description,Document) VALUES('PHP Webpage test','$testpage')");
mysql_close;   
?> 

I understood from the PHP docs that file_get_contents(…) was the preferred way to convert files into a string that could be stored in a binary field. I am aware that there are some more security issues that I will have to deal with but first I just want to be able to do the raw upload and proceed from there. Is there any reason why this should not work and if so, what is the best way to do this? Or am I just missing something?

Thanks!

R

Answer 1

You need to properly escape the string.

$testpage = file_get_contents(..);
$testpage = mysql_real_escape_string($testpage);

mysql_query("INSERT INTO theTable(Description,Document) VALUES('PHP Webpage test','$testpage')");