Hello,
Im trying to be able to upload images and show them on my website. The problem is that i heard that i shoud use addslashes after using file_get_contents so i can protect my self from sql attacks or something like that. However when i use addshalshes the image does not upload anymore(bolded the function in the code), if i remove that function it works fine. So what im i doing wrong here? code below:
if(is_array($_FILES))
{
$imagename=$_FILES[‘userImage’][‘name’];
$imagetmp=$_FILES[‘userImage’][‘tmp_name’];
if($ActualImage = addslashes(file_get_contents($imagetmp)))
{
if(exif_imagetype($imagetmp))
{
$sqlquery = "INSERT INTO Images(creator_ID,post_ID,image_name,image,imageDescription) values (?,?,?,?,?)";
$stmt = $eepdo->prepare($sqlquery);
$didImageUploadWork = $stmt->execute(array($_SESSION['user']['user_ID'],1,$imagename,$ActualImage,'description'));
echo "image uploaded to database";
$queryGetPicture = "SELECT * FROM images WHERE image_name = ?";
$stmt2 = $eepdo->prepare($queryGetPicture);
$stmt2->execute(array($imagename));
$image=$stmt2->fetch();
echo '<img src="data:image/jpeg;base64,' .base64_encode($image['image']).'"/>';
echo "<br>got picture";
}
else {
echo "thats not an image";
}
}
else {
echo "error, cant access the image... hmmm..... :/";
}
}