0

I am trying to display image from database but i can't figure it out how to display it, this is how i upload image

//image upload + validation
    $file          = $_FILES['image'];
    $file_name     = $_FILES['image']['name'];//file name
    $file_location = $_FILES['image']['tmp_name']; //temporary location
    $file_size     = $_FILES['image']['size'];// size
    $file_error    = $_FILES['image']['error'];// error 0 if no error or 1 if there is an error

    // $file = addslashes(file_get_contents($_FILES["image"]["tmp_name"]));

    $temp_extension = explode('.',$file_name);//explode from . file extension (here we have file name and extension)
    $file_extension = strtolower(end($temp_extension)); // extension name (ex: .jpg)
    $allowed_extensions = array('jpg', 'jpeg', 'png', 'pdf');

    if (in_array($file_extension, $allowed_extensions)) {
        if ($file_error === 0) {
            if ($file_size < 31457280) { //31457280b(bytes) in 30mb 
                $new_file_name = uniqid('',true).".".$file_extension;
                var_dump($new_file_name);
                $file_destination = dirname(__FILE__, 2)."/images/".$new_file_name;
                move_uploaded_file($file_location, $file_destination);
            }else {
                echo "Sorry your file size it's too big!";
            }
        }else {
            echo "Sorry, there was an error, try again";
        }
    }else {
        echo "Sorry, your file type is not accepted";
    }

    $sql = "SELECT * FROM `product` WHERE `id` = '{$_POST['id']}'";
    $result = mysqli_query(get_connection(), $sql);
    $row = $result->fetch_assoc();

    if($error_message == ""){
    
        if(is_array($row)){

            $sql = "UPDATE `product` SET `category_id` = '$category_id', `name` = '$name', `description` = '$description', `price` = '$price', `quantity` = '$quantity', `type` = '$type', `image` = '$file', `modified_on` = NOW(), `color_id` = '$color_id', `session_id` = '$session_id' WHERE `id` = '{$_POST['id']}'";
            $result = mysqli_query(get_connection(), $sql);
            // print_r($sql);
            // var_dump($sql);
        }else{

            $sql = "INSERT INTO `product` (`category_id`, `name`, `description`, `price`, `quantity`, `type`, `image`, `added_on`, `color_id`, `session_id`) VALUES ('$category_id', '$name', '$description', '$price', '$quantity', '$type', '$new_file_name', NOW(), '$color_id', '$session_id')";
            $result = mysqli_query(get_connection(), $sql);
            // var_dump($sql);
            // var_dump($sql);
        }//end elseif
        header("Location: admin.php?page=product_list");
    }//end if

And this is how i try to display image from database

<!-- TABLE BODY-->
        <tbody>
            <?php 
                foreach ($result as $row) {
                    
                    $sql_category = "SELECT * FROM `category` WHERE `id` = '{$row['category_id']}'";
                    $result_category = mysqli_query(get_connection(), $sql_category);
                    $row_category = $result_category->fetch_assoc();

                    $sql_color = "SELECT * FROM `color` WHERE `id` = '{$row['color_id']}'";
                    $result_color = mysqli_query(get_connection(), $sql_color);
                    $row_color = $result_color->fetch_assoc();
            ?>
            <tr>

                
                <td><p><?=$nr++?></p></td>
                <td><p><?=$row_category['name']?></p></td>
                <td><p><?=$row['name']?></p></td>
                <td><p><?=$row['description']?></p></td>
                <td><p><?=$row['price']?></p></td>
                <td><p><?=$row['quantity']?></p></td>
                <td><p><?=$row['type']?></p></td>
                <?php var_dump(dirname(__FILE__, 2)."/images/".$row['image']); ?>
                <td><p><img src="<?=dirname(__FILE__, 2)."/images/"?><?=$row['image'];?>" alt="" style="width: 100px; height: 100px;"></p></td>
                <td><p><?=$row['added_on']?></p></td>
                <td><p><?=$row['modified_on']?></p></td>
                <td><p><?=$row_color['name']?></p></td>
                <td>
                <button type="button" class="btn btn-outline-primary"><a href="admin.php?page=product_add_edit&id=<?=$row['id']?>">Edit</a></button>
                &nbsp;<button type="button" class="btn btn-outline-primary"><a href="admin.php?page=product_list&action=delete&id=<?=$row['id']?>" onclick="return confirm('Are you sure ?')">Delete</a></button>
                &nbsp;<button type="button" class="btn btn-outline-primary"><a href="admin.php?page=cart&action=add_to_cart&id=<?=$row['id']?>">Add to cart</a></button>
                </td>
            </tr>
            <?php }//end foreach ?>
        </tbody>
        <!-- END OF THE TABLE BODY -->
    </table>

Var_dump is displaying C:\wamp64\www\Project6Bootstrap4-V1\modules\product_list.php:101:string 'C:\wamp64\www\Project6Bootstrap4-V1/images/6103fb6fe3da77.64812338.jpg'
If i paste that adress in the browser it display that image, but if i try to copy image adress it gives me about:blank#blocked
Also in the database image type is varchar(200)

Alexandru
  • 89
  • 9
  • **Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/5741187) – Dharman Jul 30 '21 at 20:15

1 Answers1

2

This is not a valid HTTP URL:

C:\wamp64\www\Project6Bootstrap4-V1/images/6103fb6fe3da77.64812338.jpg

You're trying to have a web page access a local file, which the browser is blocking for security reasons.

Get rid of the dirname(__FILE__, 2) part and just use the URL of the image relative to the page being viewed:

/images/6103fb6fe3da77.64812338.jpg

Note that I can't know if this is the correct URL for the image. You'd have to determine what that is. But presumably you're displaying an image that's part of your website and you just need to use the URL for that image.

David
  • 208,112
  • 36
  • 198
  • 279