Member Avatar for RazorRamon

I have a mysql table that has id, name, type, size, content, and link. I have pages download.php and showimage.php. I want the link to affect the image so when the user clicks it sends them their. I only created showimage.php cause I had ran out of options on how to link and was hoping i could extract the link somehow from download.php. Heres the code for both.

Download.php

<?php
include 'config3.php';
include 'opendb.php';

$query = "SELECT name, type, size, content, link FROM `upload` ORDER BY RAND() LIMIT 1";

$result = mysql_query($query) or die('Error, query failed'); 
while($row= mysql_fetch_array($result)){
$content = $row['content']; 
$size= $row['size']; 
$type= $row['type'];
 $link= $row['link'];
header('Content-type: $type');
echo $content;
}
include 'closedb.php'; 
?>

Showimage.php

<html>
<head>
<title>Image Test</title>
</head>
 
<body>
<h1>Displaying image from database</h1>
 
<a href="download.php"><img src="download.php" height="250" width="250"/></a> </body>
 
</html>

Download.php code above only shows the image. I've tried playing with download.php to echo "<a href='".$link."'/><img src='".$content."' /></a>"; but when i do this the image turns into a huge jarbled mess. Any suggestions?

Edited by RazorRamon because: correction on code
  • 3 Contributors
  • 4 Replies
  • 3K Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by RazorRamon

Dani AI

Generated

You were close. The reason the image turns into a "garbled mess" when you echo an <a> tag from download.php is that this script should be sending only the raw image bytes with the correct HTTP Content-Type. Once you start streaming binary data, any HTML you print becomes part of that stream. Also note your header line uses single quotes, so $type is not interpolated; use header('Content-Type: ' . $type). Keep download.php binary-only, and output the clickable markup from your HTML page (as you moved toward). See the PHP header() docs and the HTTP Content-Type reference. PHP manual: header(), MDN: Content-Type.

A hardened download.php can validate input, query safely, and set headers explicitly:

<?php
$id = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);
if (!$id) { http_response_code(404); exit; }

$pdo = new PDO('mysql:host=localhost;dbname=...', 'user', 'pass', [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION
]);

$stmt = $pdo->prepare('SELECT content, type, name FROM upload WHERE id = ?');
$stmt->execute([$id]);
if (!$row = $stmt->fetch(PDO::FETCH_ASSOC)) { http_response_code(404); exit; }

header('Content-Type: ' . $row['type']);
header('Content-Length: ' . strlen($row['content']));
header('Content-Disposition: inline; filename="' . basename($row['name']) . '"');
echo $row['content'];
exit;

On the page that renders the clickable image, make sure the <a> tag is not self-closed (remove the stray /> after <a ...>), and always validate and escape the stored URL before putting it in href:

  • Validate: filter_var($link, FILTER_VALIDATE_URL)
  • Escape: htmlspecialchars($link, ENT_QUOTES)

PHP manual: filter_var.

Finally, as @diafol hinted, if you are storing images as BLOBs this streaming approach is fine; just avoid mysql_* as it is deprecated and removed in PHP 7+. Use PDO or MySQLi instead. PHP manual: ext/mysql deprecation.

Recommended Answers

All 4 Replies

Member Avatar for fobos

Here this will help. Its a good place for tutorials.

Member Avatar for RazorRamon

The tutorial you gave shows how to present the image.. which I'm already doing with the code above.. My problem is that the table also has a column for links. When the user clicks on the picture i want it to send the user to the appropriate address.

Member Avatar for RazorRamon

I figured it out.. after banging my head on the keyboard for 12 hrs... lol. I'll post the code for the sake of all the broken computer equipment out there. Here's it is.

Showimage.php

<?php
include 'config3.php';
include 'opendb.php';

$query = "SELECT id, name, type, size, content, link " .
         "FROM  `upload` ORDER BY RAND() LIMIT 1";
		 $result = mysql_query($query) or die('Error, query failed');
while($row= mysql_fetch_array($result)){
	$content = $row['content'];
		$id= $row['id'];
	$size= $row['size'];
	$type= $row['type'];
	$link= $row['link'];
	}
?>
<html>
<head>
<title>Image Test</title>
</head>
 
<body>
<h1>Displaying image from database</h1>
<a href="<?php echo $link?>" />
<img src="download.php?id=<?php echo $id?>" height="250" width="250"/>
</a>
</body>
 
</html>

Download.php

<?php
include 'config3.php';
include 'opendb.php';

if(isset($_GET['id'])){
 $id=$_GET['id']; 
}else{
echo 'did not get id'; 
}

$query = "SELECT id, name, type, size, content, link " .
         "FROM `upload` WHERE id='$id'";

$result = mysql_query($query) or die('Error, query failed');
while($row= mysql_fetch_array($result)){
	$content = $row['content'];
		$id= $row['id'];
	$size= $row['size'];
	$type= $row['type'];
	$link= $row['link'];


header('Content-type: $type'); 
echo $content;
exit();
}


include 'closedb.php'; 


?>
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.