0

I'm trying to get image urls from a MYSQL database to display on a webpage table, but most of the links are not working due to spaces in the file names. I've tried urlencode and rawurlencode and it works on some files, but not for most. I"m really not sure why some work and the other's don't. Maybe somebody here can help.

This is the output:

Not Working:

<img class="thumb" src="http://www.example.com/images/thumbnails/Brown" thrasher.jpg="">

Working:

<img class="thumb" src="http://www.example.com/images/thumbnails/Growing Ideas-Drew Lawson-1.jpg">

For some reason it's putting the quotations after the first space instead of enclosing the whole string. Yet, it works in the 2nd example.

Here is the code in question:

<td><img class='thumb' src=".$fetch[urlencode(image_link_1)]." /></td>

Where image_link_1 is a url to the image that's in a MySQL database.

Here is the whole php file: https://pastebin.com/P6epznu1

<?php
    require_once '/var/www/html/includes/artsurvey-con.php';
    if(ISSET($_POST['search'])){
        $search = urlencode($_POST['search']);
        $search1 = urldecode($search);
        $search2 = preg_replace("/[^a-zA-Z0-9,. ]/",'',$search1);
        $query = $conn->query("SELECT * FROM `art_collection_records`
            WHERE (`department` LIKE '%".$search2."%')
            OR (`building` LIKE '%".$_POST['search']."%')
            OR (`room_number` LIKE '%".$_POST['search']."%')
            OR (`contact_person` LIKE '%".$_POST['search']."%')
            OR (`category` LIKE '%".$_POST['search']."%')
            OR (`painting` LIKE '%".$_POST['search']."%')
            OR (`drawing` LIKE '%".$_POST['search']."%')
            OR (`mixed` LIKE '%".$_POST['search']."%')
            OR (`print` LIKE '%".$_POST['search']."%')
            OR (`sculpture` LIKE '%".$_POST['search']."%')
            OR (`craft` LIKE '%".$_POST['search']."%')
            OR (`title` LIKE '%".$_POST['search']."%')
            OR (`artist` LIKE '%".$_POST['search']."%')
            OR (`how_acquired` LIKE '%".$_POST['search']."%')
            OR (`back_notes` LIKE '%".$_POST['search']."%')
            OR (`written_description` LIKE '%".$_POST['search']."%')
            ORDER BY title ASC LIMIT 1200");
        $row = $query->num_rows;
        if($row > 0){
            $output = "";
            $output .= "
            <center>
            <h3>Search Results</h3>
            </center>
                <table class='table table-striped'>
                    <caption>End of Results</caption>
                    <thead class='thead-dark'>
                        <tr>
                            <th>ID</th>
                            <th>Department</th>
                            <th>Building</th>
                            <th>Room Number</th>
                            <th>Contact Person</th>
                            <th>Category</th>
                            <th>Painting</th>
                            <th>Drawing</th>
                            <th>Mixed</th>
                            <th>Print</th>
                            <th>Framed</th>
                            <th>Sculpture</th>
                            <th>Craft</th>
                            <th>Base</th>
                            <th>2D Size</th>
                            <th>3D Size</th>
                            <th>Title</th>
                            <th>Artist</th>
                            <th>Date Created</th>
                            <th>Date Acquired</th>
                            <th>Back Notes</th>
                            <th>Description</th>
                            <th>Image 1</th>
                            <th>Image 2</th>
                            <th>Image 3</th>
                        </tr>
                    </thead>
                    <tbody>";
            while($fetch = $query->fetch_array()){
                $output .= "
                        <tr>
                            <td>".$fetch['acs_id']."</td>
                            <td>".$fetch['department']."</td>
                            <td>".$fetch['building']."</td>
                            <td>".$fetch['room_number']."</td>
                            <td>".$fetch['contact_person']."</td>
                            <td>".$fetch['category']."</td>
                            <td>".$fetch['painting']."</td>
                            <td>".$fetch['drawing']."</td>
                            <td>".$fetch['mixed']."</td>
                            <td>".$fetch['print']."</td>
                            <td>".$fetch['framed']."</td>
                            <td>".$fetch['sculpture']."</td>
                            <td>".$fetch['craft']."</td>
                            <td>".$fetch['base']."</td>
                            <td>".$fetch['two_d_size']."</td>
                            <td>".$fetch['three_d_size']."</td>
                            <td>".$fetch['title']."</td>
                            <td>".$fetch['artist']."</td>
                            <td>".$fetch['date_created']."</td>
                            <td>".$fetch['date_acquired']."</td>
                            <td>".$fetch['back_notes']."</td>
                            <td>".$fetch['written_description']."</td>
                            <td><img class='thumb' src=".$fetch[urlencode(image_link_1)]." /></td>
                            <td><img class='thumb' src=".$fetch[rawurlencode(image_link_2)]." /></td>
                            <td><img class='thumb' src=".$fetch[rawurlencode(image_link_3)]." /></td>
                        </tr>";
                    }
                    $output .="
                        </tbody>
                        </table>
                        <a class='text-danger' href='#anchor'>Return to Top of Page</a>";
            echo $output;
        }else{
            echo "<center><h4>Search Not Found!</h4></center>";
        }
    }
?>

Any help is appreciated. If you need more details, please ask. Thanks!

RiggsFolly
  • 93,638
  • 21
  • 103
  • 149
  • First one isn't working as thrasher.jpg isn't an HTML attribute. (also this is open to SQL injections!) – x43 Mar 04 '21 at 18:20
  • What’s a double quote in the image url doing in this ```` i.e it’s not working – OMi Shah Mar 04 '21 at 18:20
  • Part of your problem is that this is not a valid URL. Most browsers will deal with it, but the spec for URIs and URLs do not allow spaces - the character should be percent encoded. – symcbean Mar 04 '21 at 18:35
  • It needed wrapping in quotes and it's working now. Thanks for the help everyone. What can I do to prevent SQL injections @x43? – user2824537 Mar 04 '21 at 18:58
  • 2
    See [how to prevent SQL injection](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php). – El_Vanja Mar 04 '21 at 19:04

1 Answers1

0

Because the src attribute has no quotes. So the code outputs this to the client:

<td><img class='thumb' src=http://www.example.com/images/thumbnails/Brown thrasher.jpg /></td>

Unsurprisingly, the browser is seeing thrasher.jpg as its own attribute in that markup. (The syntax highlighting on this page sees it that way as well.) While browsers can be pretty forgiving when it comes to structurally correct HTML, this is a case which demonstrates that valid HTML is indeed very important.

Wrap the attribute value in quotes, much like the code already does with the class attribute:

<td><img class='thumb' src='".$fetch[urlencode(image_link_1)]."' /></td>
David
  • 208,112
  • 36
  • 198
  • 279