WHEN I am trying to insert an image in database it's not showing any error but image is not inserting in table

Question

I am trying to insert an image in database. It's not showing any error but image is not inserting in table result is printing "not"

CODE

<?php
    if (isset($_POST['pic_upload'])) {

        if(getimagesize($_FILES['image']['tmp_name'])==False) {
            echo "select img";
        } else {
            $image = addslashes($_FILES['image']['tmp_name']);
            $name = addslashes($_FILES['image']['name']);
            $image = file_get_contents($image);
            $image = base64_encode($image);
            saveimage($name,$image);
        }
    }

    function saveimage($name,$image) {
        require 'db.php';
        $sql ="insert into blob(name,image) values('$name','$image')";
        $result=$conn->query($sql);
        if($result) {
            echo "done";
        } else {
            echo 'not';
        }
    }
 ?>

try adding back tics to your table and column names in the SQL statement. — Sloan Thrasher, Mar 30 '17 at 02:42
`Blob` is reserved. https://dev.mysql.com/doc/refman/5.5/en/keywords.html Also use parameterized queries and error reporting. — chris85, Mar 30 '17 at 02:43
Possible duplicate of [Syntax error due to using a reserved word as a table or column name in MySQL](http://stackoverflow.com/questions/23446377/syntax-error-due-to-using-a-reserved-word-as-a-table-or-column-name-in-mysql) — chris85, Mar 30 '17 at 02:44
See the linked thread and specifically `2. Use backticks` of the accepted answer. — chris85, Mar 30 '17 at 02:45
i am unable to understand .wil you please suggest me the code? — kartik, Mar 30 '17 at 02:48
**WARNING**: When using `mysqli` you should be using [parameterized queries](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) and [`bind_param`](http://php.net/manual/en/mysqli-stmt.bind-param.php) to add user data to your query. **DO NOT** use string interpolation or concatenation to accomplish this because you have created a severe [SQL injection bug](http://bobby-tables.com/). **NEVER** put `$_POST`, `$_GET` or **any** user data directly into a query, it can be very harmful if someone seeks to exploit your mistake. `addslashes` is **not** an effective escaping method. — tadman, Mar 30 '17 at 05:42

miken32 · Answer 1 · 2017-09-13T17:55:48.777

As mentioned, you need to use backticks if you're going to use a reserved word as a table name. Also you're escaping the file name, but not escaping any of the data, leaving yourself wide open to SQL injection attacks. Use prepared statements instead.

<?php
if (isset($_POST['pic_upload'])) {

    if(getimagesize($_FILES['image']['tmp_name'])==False) {
        echo "select img";
    } else {
        $name = $_FILES['image']['name'];
        $image = base64_encode(file_get_contents($_FILES['image']['tmp_name']));
        saveimage($name,$image);
    }
}

function saveimage($name,$image) {
    require 'db.php';
    $sql ="INSERT INTO `blob` (`name`, `image`) VALUES (?, ?)";
    $stmt = $conn->prepare($sql);
    $stmt->bind_param("sb", $name, $image);
    $result = $stmt->execute();
    if($result) {
        echo "done";
    } else {
        echo 'not';
    }
}
?>

WHEN I am trying to insert an image in database it's not showing any error but image is not inserting in table

1 Answers1