good upload script, problem image display script..help

hello all :)
I have managed to write my very own image upload script. Image will be uploaded to a dir, and image info will be uploaded to MySQL database. Everything seems fine so far...

The problem comes when i try to display image. Like say i click on an image link (EX. http://www.yaya.com/image.php?id=25), i couldn't view the image, just a broken image.


Here is my entire image.php script

PHP Code:

---

<?php php_track_vars?>
<?php
if(!isset($Id))
{
    die("Need 'Id' parameter");
} else
{
    $Id=addslashes($Id);
}

include("common.php");


//set up SQL connection
    $link = mysql_connect ($., $., $.);
        if (! $link)
            {
            die ("Couldn't connect to mySQL server");
            }
        if (!mysql_select_db ($db, $link) )
            {
            die ("Coldn't open $db: ".mysql_error() );
            }


$query = "SELECT * FROM tbl_Files WHERE id_files='$Id';";
$result = mysql_query($query);
    

$query_data = mysql_fetch_array($result);
$filetype = $query_data[filetype];


$photo=str_replace('$dir','',$binFile);

echo "<img src='$photo'>";

?>

---

Can somebody lead me to the right direction? is this the right way to pull/display image from the directory? Please help

thank you:p

Firstly $Id would be case sensitive - so would need $Id=25 in the url call.

Is $binFile returned from the database? If so, you'd either want extract($query_data); after the query, or $binFile = $query_data['binFile'];

Try a few echoes at various points to test that the values you are working with are actually script readable - eg echo $binFile after the query would tell you if it holds a value.

hello,
thanks

here is my form script:

PHP Code:

---

Print "<br><br>";
                print"<FORM METHOD=\"post\" ACTION=\"test.php\" ENCTYPE=\"multipart/form-data\">";
                print"<INPUT TYPE=\"hidden\" NAME=\"MAX_FILE_SIZE\" VALUE=\"$max_prop_upload\">";
                print"<INPUT TYPE=\"hidden\" NAME=\"edit\" VALUE=\"$propnum\">";
                print"<INPUT TYPE=\"hidden\" NAME=\"action\" VALUE=\"upload\">";
                print"<TABLE BORDER=\"0\" cellpadding=3>";
                print"<TR>";
                print"<TD>Title: </TD>";
                print"<TD><INPUT NAME=\"description\" COLS=\"50\"></TD>";
                print"</TR>";
                print"<TR>";
                print"<TD>File: </TD>";
                print"<TD><INPUT TYPE=\"file\" NAME=\"binFile\"></TD>";
                print"</TR>";
                print"<TR>";
                print"<TD COLSPAN=\"2\"><INPUT TYPE=\"submit\" VALUE=\"Upload\"></TD>";
                print"</TR>";
                print"</TABLE>";
                print"</FORM>";
                print "</center></td></tr></table></td></tr></table>"; 


---

In my test.php, when i click upload, the image would be sent to the folder/dir. and the info will be sent to Mysql database. here is the script to upload images:

PHP Code:

---

if  ($action == "upload")

{


              // checking the filetype to make sure it's what we had in mind

                if (!in_array($_FILES['binFile']['type'], array('image/gif', 'image/jpeg', 'image/pjpeg')))
            {
             Print "<b>$binFile_name</b> upload is an invalid file type: <b>$binFile_type</b>";
                         exit();
                        }

             // check size

        if ($max_prop_upload!=0 && $_FILES['binFile']['size']>$max_prop_upload)
            {
             Print "File is too large. you only allow $max_prop_upload bytes ";
                         exit();
                        }


              //security error
        if (strstr($_FILES['binFile']['name'],"..")!="")
            {
            Print "Security Violation!";
                        exit();
            }


              //actual upload script
              move_uploaded_file($_FILES['binFile']['tmp_name'], "$dir".$_FILES['binFile']['name'])
              or die("Couldn't copy the file!");

              // ---- insert mysql info ----
              $strDescription = addslashes(nl2br($description));
$query = "INSERT INTO tbl_Files(description, filename, filesize, filetype, owner, prop_num) 
VALUES ('$strDescription', '$binFile_name', '$binFile_size', 
'$binFile_type', '$current_user', '$propnum') ";
              $result = mysql_query($query) or die(mysql_error());
              // ---- end insert mysql info ----
             Print "<h2>Success!</h2>";

             print "<B>Uploading Status:</B><br><br>";

             echo "File Name: $binFile_name...<b>OK</b><br>";
             echo "File Size: $binFile_size bytes...<b>OK</b><br>";
             echo "The image you uploaded is ";
             echo "<a href=\"images/$binFile_name\">here</a>";

              } 


---

To answer your question pootergeist, correct me if i am wrong, $binFile should be returned from the database...

here is the new image.php script after few changes:

PHP Code:

---

if(!isset($Id))
{
    die("Need 'Id' parameter");
} else
{
    $Id=addslashes($Id);
}

include("common.php");


//set up SQL connection
    $link = mysql_connect ($server, $user, $password);
        if (! $link)
            {
            die ("Couldn't connect to mySQL server");
            }
        if (!mysql_select_db ($db, $link) )
            {
            die ("Coldn't open $db: ".mysql_error() );
            }


$query = "SELECT * FROM tbl_Files WHERE id_files='$Id';";
$result = mysql_query($query);
    

$query_data = mysql_fetch_array($result);
$binFile = $query_data['binFile'];


$photo=str_replace('$dir','',$binFile);

echo "<img src='$photo'>";

echo "$binFile"; 


---

$binFile doesnt echo anything nor does $photo ..got any idea? i know the way i try to retrieve data from both dir and database is wrong, please point it out

thanks

I can see a few things here which are likely causing your issues. Note -- I haven't really looked through your code too much because all that is hurting my eyes.

1) If you are using a URL like index.php?id=12 then to get the value of id from that URL (assuming you are PHP4.x with register_globals OFF, you will need to use $_GET["Id"] as Id won't be globally set. (BTW calling it Id [as opposed to id] it really annoying!).

2) Are you absolutely sure your image is getting uploaded? FTP into your account and check it is there. Like I said I haven't double checked your code, but the biggest thing is to ensure the path to the image is correct and that the upload isn't doing something odd to the image.

3) Your SELECT query on first glance looks wrong, as you are including a ; in it, when you don't need one. This might be breaking it causing the white screen. Remove the ; from within the " and see what happens.

4) Try switching error reporting on to see if you are getting any error messages, use error_reportin(E_ALL); at the top of your page.