Question

Why the following php script doesn’t show the image. I checked that database connection is OK and Mysql Query is also Ok.

Php Code:

$upload_directory = "uploaded"; //set upload directory

$getimages = mysql_query("SELECT * FROM property_step3 WHERE propertyid =  
'$propertyid' AND active =1 AND uname = '$uname'"); 

$re2 = mysql_fetch_array($getimages)
$images = mysql_real_escape_string(htmlspecialchars(trim($re2['imgname'])));


echo '<img src="$upload_directory/$images" width="98" height="68"  /></a>'; 

May be I’m wrong..

I don’t understand why are some people are voting me DOWN ??!!

Update:

<?php
 $uname = $_SESSION['uname'];
 $check = mysql_query("SELECT * FROM property_step1 WHERE uname = '$uname' AND active 
 = 1");
 $num = mysql_num_rows($check);

if($num == 0)
{

echo "<h3>You didn't upload any property. Click <a href='publishadvert.php'>here</a> 
to publish your property</h3>";

}
else
{
    echo "<h3>You have $num published property.</h3>";

    echo "<table width='1020' cellpadding='0' cellspacing='0'>";
        echo "<tr>";
    echo "<td class='tabletr3'><b>Property Title</b></td>";
    echo "<td class='tabletr3'><b>Area</b></td>";
    echo "<td class='tabletr3'><b>State</b></td>";
        echo "<td class='tabletr3'><b>City</b></td>";
    echo "<td class='tabletr3'><b>Country</b></td>";            
    echo "<td class='tabletr3'><b>Images</b></td>";         
    echo "<td class='tabletr3'><b>Action</b></td>";         
    echo "</tr>";

    while($re = mysql_fetch_array($check))
    {
$propertyid = (int) $re['propertyid'];  
$country = mysql_real_escape_string(htmlspecialchars(trim($re['pro_country'])));
$state = mysql_real_escape_string(htmlspecialchars(trim($re['pro_state'])));
$area = mysql_real_escape_string(htmlspecialchars(trim($re['pro_area'])));
$city = mysql_real_escape_string(htmlspecialchars(trim($re['pro_city'])));
$title = mysql_real_escape_string(htmlspecialchars(trim($re['pro_title'])));

 $getimages = mysql_query("SELECT * FROM property_step3 WHERE propertyid = 
 '$propertyid' AND active =1 AND uname = '$uname'");

    $upload_directory = dirname(__file__) . '/uploaded/'; //set upload directory    
while($re2 = mysql_fetch_array($getimages))
{
$images = mysql_real_escape_string(htmlspecialchars(trim($re2['imgname'])));
}



        echo "<tr>";
            echo "<td class='tabletr2'>$title</td>";
            echo "<td class='tabletr2'>$country</td>";
            echo "<td class='tabletr2'>$state</td>";
            echo "<td class='tabletr2'>$city</td>";
            echo "<td class='tabletr2'>$area</td>";     
                  echo '<img src="'.$upload_directory.'/'.$images.'" width="98" 
 height="68"  /></a>';      

echo "<td class='tabletr2'><img src='uploaded/$images' 
/></td>";                               
echo "<td class='tabletr2'><a href='editproperty.php?propertyid=$propertyid&
uname=$uname'>Edit</a> | <a href='deleteproperty.php?propertyid=$propertyid'>Delete</a>
</td>";
    echo "</tr>";
    }  
    echo "</table>";

     }
 ?>

Answer 1

Mistake 1: What Waqar Alamgir said, but more explicitly. Trying to use variables in single quotes.

echo '<img src="$upload_directory/$images" width="98" height="68"  /></a>'; 

will output

<img src="$upload_directory/$images" width="98" height="68"  /></a>

whereas

echo "<img src=\"$upload_directory/$images\" width=\"98\" height=\"68\"  /></a>"; 

or

echo '<img src="'. $upload_directory . '/' . $images .'" width="98" height="68"  /></a>'; 

or

echo '<img src="', $upload_directory, '/', $images, '" width="98" height="68"  /></a>'; 

will output

<img src="uploaded/theimagename.jpg" width="98" height="68"  /></a>

where $images equals theimagename.jpg

Mistake 2: (Spotted by Pankaj Khairnar)

$re2 = mysql_fetch_array($getimages)

is missing a semi-colon. This will break your script.

$re2 = mysql_fetch_array($getimages);

Mistake 3 (c/o Michael Berkowski)

Don’t call mysql_real_escape_string() on output data