Store path to uploaded Image in database

Question

I'm trying to add a path of an uploaded image to the database in order to use it to display it as a thumbnail for a post. I found a tutorial and I used this code to upload the image. However it gets to the else statement and I just get the exit("Error While uploading image on the server"); I have a form to collect the data:

<form action='' method='post' enctype="multipart/form-data">

<p><label>Title</label><br />
<input id="title-input" type='text' name='postTitle' value='<?php if(isset($error)){ echo $_POST['postTitle'];}?>'></p>

<p><label>Description</label><br />
<textarea id="textarea" name='postDesc' cols='20' rows='5'><?php if(isset($error)){ echo $_POST['postDesc'];}?></textarea></p>

<p><label>Content</label><br />
<textarea name='postCont' cols='20' rows='5'><?php if(isset($error)){ echo $_POST['postCont'];}?></textarea></p>

<p><label>Image</label><input type="file" name="uploadedimage">
                            </p>

<input type='submit' name='submit' value='Submit'>
<input type='reset' name='submit' value='Reset'>

</form>
<?php include 'add-post-handler.php' ?>

And here is the code I used to upload the image:

function GetImageExtension($imagetype)
    {
       if(empty($imagetype)) return false;
       switch($imagetype)
       {
           case 'image/bmp': return '.bmp';
           case 'image/gif': return '.gif';
           case 'image/jpeg': return '.jpg';
           case 'image/png': return '.png';
           default: return false;
       }

     }

if (!empty($_FILES["uploadedimage"]["name"])) {
    $file_name=$_FILES["uploadedimage"]["name"];
    $temp_name=$_FILES["uploadedimage"]["tmp_name"];
    $imgtype=$_FILES["uploadedimage"]["type"];
    $ext= GetImageExtension($imgtype);
    $imagename=$_FILES["uploadedimage"]["name"];
    $target_path = "../img/".$imagename;

if(move_uploaded_file($temp_name, $target_path)) {
    $query_upload="INSERT INTO blog_images (imgPath) VALUES
('$target_path')";
    mysqli_query($link, $query_upload) or die("error in $query_upload == ----> ".mysql_error()); 
}else{
   exit("Error While uploading image on the server");

}
}

PS: I also have some doubts on how can I get the imageID to be related with the postID considering that are both submitted from the same form.(I made a relation between the two tables but it's on the primary keys so I'm not sure if it's correct)

Thanks for your help!

Try this: http://php.net/manual/en/function.mysql-insert-id.php — Érycson Nóbrega, May 25 '16 at 08:06
There may be something in this post that will guide you as to why the move_uploaded_file is failing : http://stackoverflow.com/questions/3586919/why-would-files-be-empty-when-uploading-files-to-php — PaulF, May 25 '16 at 08:27

nv1t · Answer 1 · 2016-05-25T08:38:22.860

Looking at the Code:

move_uploaded_file returns FALSE on two premises (stated in the PHP Docs):

If filename is not a valid upload file, then no action will occur, and move_uploaded_file() will return FALSE.

If filename is a valid upload file, but cannot be moved for some reason, no action will occur, and move_uploaded_file() will return FALSE. Additionally, a warning will be issued.

My best guess is, with the information you provided:

Your path is not writeable by your application/webserver, so it won't be moved

Make sure the application (the webserver) can write in your path: '../img/' by issuing a chmod to give the directory the correct rights for the webserver user.

Security Advice (not related to question):

Your application has in this state a potential SQLi in $target_path. You should think about using prepared statements
- https://dev.mysql.com/doc/apis-php/en/apis-php-mysqli.quickstart.prepared-statements.html
Your form writes POST Data directly to output. This leads to XSS. You should always encode special characters in your output.
- https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29
Make sure, only images can be uploaded and scripts can't be executed in this '../img' path. Somebody could exploit your upload to upload a script and execute it.

easiest way to prevent SQLi in this case would be hashing the imagename and setting the extension with the $ext variable:

[...]
$ext=GetImageExtension($imgtype);
if($ext === FALSE) {
    exit("Couldn't determine the filetype correctly. Please upload pictures only.");
}
$imagename=md5($_FILES["uploadedimage"]["name"].time()).$ext;
$target_path = "../img/".$imagename;
[...]

The time() is only included, so somebody can upload pictures with the same name.

The first problem to solve (I'd say with about 95% certainty) is that the destination directory is not writeable by the apache (or other web server) user. — Chris Lear, May 25 '16 at 08:32

score 0 · Answer 2 · answered May 25 '16 at 08:16

0

you could always give your images a specific class that you know directs to all images you want to thumbnail and apply a CSS rule/code that will automatically make them img-thumbnail.

<div class="imgT">

then set your CSS thumbnail

answered May 25 '16 at 08:16

Siyanda Jacobs

23
8

score 0 · Answer 3 · edited May 23 '17 at 10:28

Thanks everyone for answering. In the end I got it. I found that the problem was with the php.ini settings. This is the link that helped me -> Why would $_FILES be empty when uploading files to PHP?. Thanks PaulF for posting it. The problem was that the limit for uploading files was just 2MB or something like that. For everyone having the same issues make sure you check that link and check this settings in your php.ini file.

file_uploads = On
post_max_size = 100M
upload_max_filesize = 100M

Store path to uploaded Image in database

3 Answers3