1

I am attempting to insert an image into a table called "users" in my database. The database already contains records but the "name" column (which is where the image should upload) are empty in the database as it is a new column added. on the users profile.php page I have an INSERT Statement to insert the image into the database however I want to insert the image into the "name" column of the record which has the "user_id" equal to the user_id of the user logged in.

I am able to pull the image from the table using user_id=$_SESSION['userSession']

This pulls only the image which holds the user_id of the user logged in. I basically want to do the same but with an insert statement so the image is inserted into the correct record. Not sure if this will be possible. My code for the insert and select is below. I have also added a screen shot of my database in the link below. Thanks for any help in advance.

Screen Shot of Database table

<?php

$connect = mysqli_connect("localhost", "B00634251", "95c24bPw", "b00634251"); 

 if(isset($_POST["insert"]))  
{  
  $file = addslashes(file_get_contents($_FILES["image"]["tmp_name"]));  
  $query = "INSERT INTO users(name) VALUES ('$file') WHERE user_id=".$_SESSION['userSession'];  
  if(mysqli_query($connect, $query))  
  {  
       echo '<script>alert("Image Inserted into Database")</script>';  
  }  
 }  
 ?> 



 <div class="container" style="width:500px;">  
            <h3 align="center">Insert and Display Images From Mysql Database in PHP</h3>  
            <br />  
            <form method="post" enctype="multipart/form-data">  
                 <input type="file" name="image" id="image" />  
                 <br />  
                 <input type="submit" name="insert" id="insert" value="Insert" class="btn btn-info" />  
            </form>  
            <br/>  
            <br/>  
            <table class="table table-bordered">  
                 <tr>  
                      <th>Profile Picutre</th>  
                 </tr>  
            <?php  
            $query = ("SELECT name FROM users WHERE user_id=".$_SESSION['userSession']);  
            $result = mysqli_query($connect, $query);  
            while($row = mysqli_fetch_array($result))  
            {  
                 echo '  
                     <tr>  
                           <td>  
                                <img src="data:image/jpeg;base64,'.base64_encode($row['name'] ).'" height="200" width="200" class="img-thumnail" />  
                           </td>  
                      </tr>  
                 ';  
            }  
            ?>  
            </table>  
       </div>  

  <?php  
Alex2017
  • 11
  • 2
  • If the record already exists in your db, you need an UPDATE query, not INSERT (which will create a new one). Something like `UPDATE users SET name = ? WHERE user_id = ?` This is a prepared statement syntax, please stop using mysqli. Read more: [link](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) – Arbels May 04 '17 at 03:24

0 Answers0