php - 从 MySQL 数据库中检索图像

Question

我正在使用下面的代码从 mysql 数据库上传和检索图像。图像已成功上传并移动到单独的文件夹，但图像路径未存储在数据库中，因此我无法从数据库中检索图像。请检查是哪里出了问题

if(isset($_POST["submit"])){
              $check = getimagesize($_FILES["image"]["tmp_name"]);
            if($check !== false){
              $target="images/".basename($_FILES["image"]["tmp_name"]);
              $image = $_FILES['image']['tmp_name'];
              $imgContent = addslashes(file_get_contents($image));
              $uploadfilename=$_FILES['image']['name'];
        /*
         * Insert image data into database
         */

       $db = new mysqli($dbHost, $dbUsername, $dbPassword, $dbName);
        $dataTime = date("Y-m-d H:i:s");

        //Insert image content into database
          $insert = $db->query("INSERT into images (image,created)   VALUES('$imgContent', '$dataTime')");
      //move uploaded file to the folder images//


      if($uploadfilename!=''){
        move_uploaded_file($_FILES["image"]["tmp_name"],$target)
          $query="INSERT INTO images SET imgepath='$uploadfilename' ";
        mysqli_query($query);
        if($query){

           { 
            echo "File uploaded  successfully.";
           }
        }else{
            echo "File upload failed, please try again.";
        } 
    }else{
        echo "Please select an image file to upload.";
    }
    }
    }
   }
    ?>

Answer 1

您应该放置图像的文件夹路径或您的 $target 变量而不是 $imgContent。

"INSERT into images (image,created) VALUES('$target', '$dataTime')"

这也很容易被 SQL 注入(inject)，使用准备好的语句:

// connection
$conn = new mysqli($servername, $username, $password, $dbname);

// prepare and bind
$stmt = $db->prepare("INSERT into images (image,created) VALUES(?, ?)");

$stmt->bind_param("ss", $target, $dataTime);

//execute
$stmt->execute();