Having error in saving image link to the database using pdo

Question

I want to do is make a image uploader system and send the image to upload folder and save the link to the database.

My problem is I got this to errors in my images.php can anyone help me with this please.

html:

<form method="post" enctype="multipart/form-data">  
<img id="picture" data-src="#" /> <br />
<input type='file' name="image" id="imgInp" accept="image/*" /><br />
<input type="submit" name="submit" id="submit" value="submit" />
</form>

script:

<script type="text/javascript">
$(document).ready(function() {

   $('#submit').click(function (e) {
       e.preventDefault();

        var data = {};

        data.image = $('#imgInp').val();


        $.ajax({
            type: "POST",
            url: "images.php",
            data: data,
            cache: false,
            success: function (response) {


            }
        });
            return false;
    });

});
</script>

images.php

<?php
$host = "localhost";
$user = "root";
$pass = "";
$db = "test";

$dbc = new PDO("mysql:host=" . $host . ";dbname=" . $db, $user, $pass);
$dbc->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

$image = addslashes(file_get_contents(@$_FILES['image']['tmp_name']));
$image_name = addslashes(@$_FILES['image']['name']);
$image_size = getimagesize(@$_FILES['image']['tmp_name']);

move_uploaded_file(@$_FILES["image"]["tmp_name"], "upload/" . @$_FILES["image"]["name"]);
$location = "upload/" . @$_FILES["image"]["name"];

$q = "INSERT INTO students( image ) VALUES( :image)";

$query = $dbc->prepare($q);
$query->bindParam(':image', $location);


$results = $query->execute();

?>

script for image upload:

<script type="text/javascript">
$(document).ready(function() {
    var currentSrc = $('#picture').attr('src');
    if(currentSrc==null || currentSrc==""){        
    $('#picture').attr('src','http://i38.photobucket.com/albums/e149/eloginko/profile_male_large_zpseedb2954.jpg');

   $("#picture").on('click', function() {
       $("#imgInp").trigger('click')}
   )}


    function readURL(input) {
        if (input.files && input.files[0]) {
            var reader = new FileReader();

            reader.onload = function (e) {
                $('#picture').attr('src', e.target.result);
            }

            reader.readAsDataURL(input.files[0]);
        }
    }

    $("#imgInp").change(function(){
        readURL(this);
    });

});
</script>

Answer 1

The simplest thing to get rid of the error messages is to actually place a conditional that checks if $_FILES has anything in it. But past that, unclear on the root cause of $FILES being empty. In my experience Ajax file uploading with a PHP receiver on the other side just doesn’t work consistently at best. Anyway, here is my version of your code with a conditional in place:

if (!empty($_FILES)) {

    $image = addslashes(file_get_contents(@$_FILES['image']['tmp_name']));
    $image_name = addslashes(@$_FILES['image']['name']);
    $image_size = getimagesize(@$_FILES['image']['tmp_name']);

    move_uploaded_file(@$_FILES["image"]["tmp_name"], "upload/" . @$_FILES["image"]["name"]);
    $location = "upload/" . @$_FILES["image"]["name"];

    $q = "INSERT INTO students( image ) VALUES( :image)";

    $query = $dbc->prepare($q);
    $query->bindParam(':image', $location);


    $results = $query->execute();

}

Answer 2

Try this approach, it might look like too many if statement, but you need to have checks if you want solid code:

if(is_uploaded_file($_FILES['image']['tmp_name'])){ 
    $folder = "upload/"; 
    $file = basename( $_FILES['image']['name']); 
    $full_path = $folder.$file; 
    if(move_uploaded_file($_FILES['image']['tmp_name'], $full_path)) { 
        echo "succesful upload, we have an image!";
        //PDO
        $dbc = new PDO("mysql:host=" . $host . ";dbname=" . $db, $user, $pass);
        $dbc->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        $query = "INSERT INTO students( image ) VALUES( :image)";
        $stmt = $dbc->prepare($query);
        $stmt->bindParam(':image', $full_path);
        $results = $stmt->execute();
        if($results){
            echo "Insert successful!";
        }else{
             echo "Insert failed!";
        }
    } else { 
       echo "upload received! but process failed";
    } 
}else{ 
    echo "upload failure ! Nothing was uploaded";
} 

Few things I would like to point out:

• @ suppress error, you don't want that when you troubleshoot, even in production, you still want to be aware of the error.
• You should enable error reporting
• You didn't check if php script receives the image upload.
• The use of file_get_contents is unclear in this case
• You don't make use of the $image* variables ? ....