image wont display in php page

Question

There is "RestaurantQuery.php" page

where you can upload restaurant name, description and logo to mysql database and display it on the "restaurants.php" page.

The problem that i'm facing is that the image wont show on "restaurants.php" page if i upload it through "RestaurantQuery.php" page.

If i upload the image in phpMyAdmin directly it works and it is displayed without any problems.

"RestaurantQuery.php" code:

    <?php

$connection = mysqli_connect("localhost:3307", "root", "", "foodstation");
$db = mysqli_select_db($connection,'foodstation');

if(isset($_POST['submit']))
{

  $query_run = mysqli_query($connection,"insert into restaurants (name, logo, description) values ('$_POST[name]', '$_POST[logo]', '$_POST[description]')");

  if($query_run)
  {
    echo '<script> alert("Restaurant has been uploaded")</script>';
  }
  else{
    echo '<script> alert("Restaurant has not been uploaded")</script>';
}
}
?>
<!DOCTYPE html>
<html>
<head> <title> Restaurant Query </title>
    <meta charset="utf-8">
<link rel="stylesheet" href="RestaurantQuery-style.css">
</head>
<body>
<div class="container">
  <a href="./login.php" class="AdminLogin">Log-in</a>
  <a href="./index.html" class="Home">Home</a>
  <a href="./AboutUs.html" class="AboutUs">About us</a>
  <a href="./Restaurants.php" class="Restaurants">Restaurants</a>
  <a href="./Cafes.html" class="Cafes">Cafés</a>
    <input type = "search" class = "search" placeholder="  search">
    <div class="divider"> </div>
  </div>
    <img src="logo.png" class="logo">
    <hr class="divider1"width=1 size=959>





    <div class="bodyc1">
<h1> <span style="color: #476e9e"> Add Restaurant </span> </h1>
<form method="post" action="RestaurantQuery.php" enctype='multipart/form-data'>
  <label> Restaurant name: </label>
  <input type="text" name="name">
  <br>
  <br>
  <label> Restaurant description: </label>
  <input type="text" name="description">
  <br>
  <br>
  <label> Restaurant logo: </label>
    <input type="file" name="logo" accept="image/*">
    <br>
    <br>
    <input type="submit" name="submit" value="Add Restaurant">
  </form>
</div>

This is "restaurants.php" page

test1 has been uploaded through phpMyAdmin directly. test2 has been uploaded through "RestaurantQuery.php" page.

"Restaurants.php" code:

<?php
  $conn = mysqli_connect("localhost:3307", "root", "", "foodstation");
    if ($conn->connect_error) {
      die("Connection failed: " . $conn->connect_error);
    }
    $sql = "SELECT * FROM restaurants";
    $result = $conn->query($sql);

    if ($result->num_rows > 0) {
      while($row = $result->fetch_assoc()) {
        echo "<br>".$row["name"]."<br>"; 
        echo "<br>".$row["description"]."<br>"; 
        echo '<img src="data:image/jpeg;base64,'.base64_encode($row['logo']).'"/>';
      }
    
    } else {
      echo "0 results";
    }
$conn->close();
?>

Uploaded files aren't in `$_POST`, they're in `$_FILES`. You need to move the uploaded file to a named file on the server, then put the URL of the file into the `` tag. — Barmar, Oct 28 '22 at 19:20
**Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/32391315) — Dharman, Oct 28 '22 at 19:20

score 0 · Accepted Answer · answered Oct 28 '22 at 19:26

The uploaded file data isn't in $_POST['logo'] it's in the file named in $FILES['logo']['tmp_name'].

if(isset($_POST['submit']))
{
    $name = $_POST['name'];
    $description = $_POST['description'];
    $logo = file_get_contents($_FILES['logo']['tmp_name']);
    
    $stmt = $connection->prepare("insert into restaurants (name, logo, description) values (?, ?, ?)");
    $stmt->bind_param("sss", $name, $logo, $description);
    $query_run = $stmt->execute();
    
    if($query_run)
    {
        echo '<script> alert("Restaurant has been uploaded")</script>';
    } else
    {
        echo '<script> alert("Restaurant has not been uploaded")</script>';
    }
}

image wont display in php page

1 Answers1