Store files in MySQL database from HTML form.

Question

Hey Guys, I've got the following HTML form. As you can see it's saving a file.

<form enctype="multipart/form-data" action="welcome.php" method="post
"onsubmit="return validateFormOnSubmit(this)"> 
 <b>Name</b><br/> <input type="text" name="fname" /> 
 <br/>
 <b>Description</b><br/> <TEXTAREA NAME="description" COLS=40
 ROWS=6></TEXTAREA><br/><br/> <input type="hidden" name="MAX_FILE_SIZE" value="100000"/> 

<b>Upload Picture</b><br/> <input name="uploadedfile" type="file" /><br /> 
 <b>Latitude</b><br/><INPUT name="lat" id ="lat" /><br/> 
 <b>Longitude</b><br/><INPUT     name="lng" id ="lng" /><br/> <input type="submit" />

This file is being processed like so...

 $target_path = "uploads/";

 $target_path = $target_path . basename( $_FILES['uploadedfile']['name']);

The rest of the information is being stored in a SQL database. I'd like to store the file uploaded in that database. How would I go about doing this via the php file the information get's sent to? I'm inserting it like..

   $query = "INSERT INTO <TABLE> (name, message, lat, lng, type)VALUES ('".$title."', '".$des."', '".$lati."', '".$long."', '".$type."')";
   $q=mysql_query($query) or die(mysql_error());

Answer 1

You mean the contents of the uploaded file?

Pretty much like below:

// Obtain the file content (add error handling here...)
$contents = file_get_contents($_FILES['uploadedfile']['tmp_name']);
// Escape all special characters
$contents = mysql_real_escape_string($contents)
// Do the insert
$query = 'INSERT INTO <TABLE> (....) VALUES ("' . $contents . '")';
$q=mysql_query($query) or die(mysql_error());

Edit: marvin is right, its file_get_contents.

Answer 2

I would suggest storing a reference to the file in the database not the actual file. Here is a really good pdf on file upload/security, the final few pages of this pdf show an example of how to implement the solution too. Otherwise I guess you could base64 encode the file and store that, serious memory usage though and not good practice I dont think.

Hope this helps

Luke

Answer 3

If you definitely want to insert your html file in your MySQL db, there are two ways :

1) using BLOB type to store the file 2) convert your file into a string, as it is html, and store it in a text field.

However, my recommandation would be to store files on the server filesystem, and not in database.

Answer 4

You can do this in tow ways.

1. Copying the file into filesystem and saving its path in database

2. Storing the file as binary data in database.

   $data = file_get_contents($_FILES['photo']['tmp_name']);
   $data = mysql_real_escape_string($data);
   

and then save data in a field (you need to create that field as blob)