0

I try to make a page, I take a picture from the database I put it in the tag <img> after, I want to update where id is equal, taken from a table in the id column. I click <input> but nothing happens.

<?php
if (isset($_GET["ID"])){
    $ID=$_GET["ID"];
    require("includes/connect.php");
$query=mysqli_query($con,"SELECT items.ID,items.image
        from items where id=$ID");
    $result=mysqli_fetch_assoc($query);

?>  
    <form  method="post" enctype="multipart/form-data">

    <?php
    $query=mysqli_query($con,"SELECT items.ID,items.image from items where id=$ID");
    $result=mysqli_fetch_assoc($query);
    echo '<img class="popup_image" src="data:image/jpeg;base64,'.base64_encode($result['image'] ).'" height="500" width="400" />';

    echo '<input type="submit" name="update" id="valid" value="Update">';

    ?>
    <input type="file" name="image" id="image" /></p><br />
    <input  name="idimg" value="<?php echo $_GET["ID"];?>">


    </form>
    <?php
}

?>

<?php
    if(isset($_POST["update"])){

        $file = addslashes(file_get_contents($_FILES["image"]["tmp_name"]));

        $ID=$_GET["ID"];

        $query=mysqli_query($con, "UPDATE items set image='$file' where id=$ID");

        if(mysqli_affected_rows($con)==1) echo "<script>alert('good');document.location='list.php';</script>";
        else echo "<script>alert('Not good".mysqli_error($con)."';</script>";

    }
?>

The rest of the code above seems to go .. it makes the selection of ID and image selection web

Your Common Sense
  • 156,878
  • 40
  • 214
  • 345
Rasti
  • 25
  • 1
  • 5
  • 1
    Your code is vulnerable to [**SQL injection**](https://en.wikipedia.org/wiki/SQL_injection) attacks. You should use prepared statements with bound parameters, via either [**mysqli**](https://secure.php.net/manual/en/mysqli.prepare.php) or [**PDO**](https://secure.php.net/manual/en/pdo.prepared-statements.php). [**This post**](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) has some good examples. – Alex Howansky May 09 '19 at 15:52
  • @AlexHowansky, ok.. but i don't care about attacks, i just needed to do that Update to work.. – Rasti May 09 '19 at 15:56
  • In if statement doesn't enter, and i tried to put id=1 and it doesn't work.. – Rasti May 09 '19 at 15:59

0 Answers0