Member Avatar for vernz

Hi everyone

New to the site (as you can tell)

I've searched the web and your site and still struggle to find an answer to my question.

I'm creating a profile website in PHP, I have my sign up and login forms, which registers the details on my sql database, then the user has access to a registered user only page.

What I want to create tho is a page whereby when logged in they can create a profile for themselves, upload a picture and advertise on my community.

I hope you can help and look forward to being a part of this online community and again I apologise if this has been covered already

Andy

  • 5 Contributors
  • 6 Replies
  • 121 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by vernz

Dani AI

Generated

Practical, secure steps to add a per-user profile editor and avatar upload — a compact plan and minimal examples that build on suggestions from , and others.

Start with a small profile table that links to your existing users table. Store the avatar filename (not the binary) and any moderation flags so you can approve ads before they appear:

CREATE TABLE profiles (
  user_id INT PRIMARY KEY,
  display_name VARCHAR(100),
  bio TEXT,
  avatar_path VARCHAR(255),
  ads_enabled TINYINT(1) DEFAULT 0,
  ad_moderated TINYINT(1) DEFAULT 0,
  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
  updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
);

Secure upload handler (outline). Key checks: session-authenticated user, multipart/form-data form, check $_FILES['avatar']['error'], validate image with getimagesize() and MIME whitelist, generate a random filename, store files outside webroot, and update DB with a prepared statement:

$info = getimagesize($_FILES['avatar']['tmp_name']);
$allowed = ['image/jpeg'=>'jpg','image/png'=>'png'];
$ext = $allowed[$info['mime']] ?? null;
$filename = bin2hex(random_bytes(16)).".$ext";
move_uploaded_file($_FILES['avatar']['tmp_name'], "/path/outside/webroot/avatars/$filename");
$stmt = $pdo->prepare('UPDATE profiles SET avatar_path=:p WHERE user_id=:id');
$stmt->execute([':p'=>$filename, ':id'=>$_SESSION['user_id']]);

Extra practical notes and security links: store only user_id in session, call session_regenerate_id(true) after login, use prepared statements (PDO) and password_hash() for auth, add CSRF tokens to forms, sanitize or whitelist any HTML in ads, and moderate uploads before public display. File uploads are a major attack surface — validate size, MIME, extension, and run server-side checks. See the PHP upload docs and getimagesize() for validation, and OWASP guidance on file uploads, XSS and CSRF for hardening.

References: PHP file upload docs, getimagesize, PDO::prepare, OWASP Unrestricted File Upload, OWASP XSS Prevention Cheat Sheet.

Recommended Answers

All 6 Replies

Member Avatar for Amr87

Well Andy , I think this is a whole project task and you need to pay for someone to make him tackle it for you or even make him a partner in this project ;)

Member Avatar for turt2live

Start by getting a working login/logout/register script. Once that is done, look into file uploads, html/css, javascript, and what other "edit account" pages look like on other websites.

Structure your "edit account" to be easy to use and understand.

If you don't know how to o this, as Amr87 said, you would need to look into hiring someone.

Member Avatar for gonidelux

Hey wernz i have one contact me [snipped]

Edited by Ezzaral because: Snipped email. Please keep it on site.
Member Avatar for MooGeek

Use CMS or OpenSource projects like this?

Member Avatar for MooGeek

Welcome to Daniweb btw :)

Member Avatar for vernz

hey guys thanks for your advice. from what i understand its all relating to php sessions and how they get the info from sql.
i have my login and registration set up and now will attempt the profile aspect.. ill let you know how i get on :)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.