MySQL Syntax Error When Uploading Image

Question

I'm having issue uploading a BLOB into my MySQL database and get the following error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzƒ„…†‡ˆ‰Š’“”•–—˜™š¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄ' at line 1

I know the error is resulting in the image's file contents but I can't figure out what's wrong with the syntax. Any suggestions? Thanks!

Here's the PHP:

    $file = $_FILES['image']['tmp_name'];

// If there's no file selected when button is pressed, echo out and tell the user to select an image to upload
if (!isset($file))
    echo "<p>Please select an image to upload.</p>";
else {
    //mysql escape string
    $image = file_get_contents($_FILES['image']['tmp_name']);
    //and here
    $image_name = $_FILES['image']['name'];
    $imagesize = getimagesize($_FILES['image']['tmp_name']);
}

// Checks that the file being uploaded is an image, i.e. has a size attribute with height & width dimensions
if ($imagesize == FALSE)
    echo "<p>Please upload only an image file such as .jpg or .png.</p>";
else {
    $sql = "INSERT INTO design (id, caption, image) VALUES ('', '$image_name', '$image')";
    $result = mysql_query($sql);
    if (!$result)
        echo "<p>Something went wrong.</p>" . mysql_error();
    else {
        echo "<p>Thank you for submitting your design.</p>";
    }
}

Instead of stuffing images in database you have to store them in a filesystem — Your Common Sense
– Your Common Sense, Commented Apr 7, 2013 at 20:27

Explosion Pills · Accepted Answer · 2013-04-07 20:25:09Z

2

Apparently the image file contents has an apostrophe in it. That's not that surprising. You need to properly escape the input (and all inputs for that matter).

$image = mysql_real_escape_string($_FILES['image']['tmp_name']);

Instead of using ext/mysql, you should use properly parameterized queries with mysqli or PDO. Then you don't have to escape explicitly.

answered Apr 7, 2013 at 20:25

Explosion Pills

192k56 gold badges341 silver badges417 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Diemuzi Over a year ago

Only problem with your answer is that you're still using the mysql_* functions which have been depreciated and I would recommend not using them.

Explosion Pills Over a year ago

@Diemuzi I do in the second paragraph

Owen Edwards Over a year ago

Thanks! I even commented in my code to add mysql_real_escape_string to both those variables! I'm an idiot.

Collectives™ on Stack Overflow

MySQL Syntax Error When Uploading Image

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related