[SOLVED] Working with Images?

[stublackett]

Hi Guys,

 

I've got a "directoryitem.php" page setup, The page is managed dynamically by a Content Management System, The user can add 2 images to the Directory Item

The image uploads etc, No problem

 

What I want to do is, If a user doesnt upload an image, I would like to make it a pre-set image titled "blank.jpg" how do I achieve this?

 

I'm thinking of doing this with an IF statement after the MYSQL Select Command something like

 

IF $image1 = ../directoryimages/

 

$image1 = ../directoryimages/blank.jpg

 

Is this the way to do this? Or can anyone tell me another way to achieve this?

 

My code is :

 

<?php
$id = $_GET['id'];
$result = mysql_query("SELECT * FROM $db_table2 WHERE id='$_GET[id]'");
while($myrow = mysql_fetch_assoc($result))
              
        {//begin of loop
$title = $myrow['title'];
$address = $myrow['address'];
$postcode = $myrow['postcode'];
$telephone = $myrow['telephone'];
$email = $myrow['email'];
$website = $myrow['website'];
$info = $myrow['info'];
$image1 = $myrow['image1'];
$image2 = $myrow['image2'];
$category = $myrow['category'];

}//End While loop
?>

 

[Fadion]

Yeah sure, that's a good and simple way. Just check:

 

<?php
if($image1 == ''){
     echo "<img src='images/blank.jpg' />";
} else{
     echo "<img src='images/{$image1}' />";
}
?>

 

Maybe you've saved your images as blobs in the db, so the < img /> tag doesn't count in that case, but you should have the idea. Also i noticed:

<?php
$id = $_GET['id'];
$result = mysql_query("SELECT * FROM $db_table2 WHERE id='$_GET[id]'");
?>

 

I guess $db_table2 is a variable so i'm not complaining about that . Instead what I don't like is the security hole you have there with querying the db directly without first escaping input (in this case $_GET['id']). Just make the first line like this:

<?php
$id = mysql_real_escape_string($_GET['id']);
?>

 

Make it a coding practice and you won't have problems from such simple-to-fix security holes.

[stublackett]

Cheers for that GuiltyGear

 

Especially for the Security Advice with the $id

 

I've got that in place, I've got the images saved as URL Strings rather than blobs in the DB

 

My problem is, When I go to load the image in now, Its not loading... Even though it exists

 

When I've looked at the properties of the image that should be there I'm getting :

/%3Cimg%20src='/directoryimages/Tillmouth-Park-Autumn.jpg'%20/%3E

 

My code is following your principles, Now set as

 

<?php
if($image1 == ''){
     $image1 = "images/blank.jpg />";
} else{
     $image1 = "<'{$image1}' />";
}
?>

 

The reason I'm setting $image1 is that when it comes to the image in the HTML All I'm doing is :

<img src="<?php echo $image1 ; ?>" alt="<?php echo $image1 ; ?>" width="235" height="200" border="0" />

[stublackett]

Not to worry.....

 

Think I've sorted it

 

Using your principles, I put the PHP Code in the <img src=<?php etc etc>

 

That seems to have done the trick

 

Thanks

[Fadion]

Ohh you're getting the entities for { } in your html code. If you are going to show images with:

 

<img src="<?php echo $image1 ; ?>" alt="<?php echo $image1 ; ?>" width="235" height="200" border="0" />

 

then the code should be:

<?php
$image1 = $myrow['image1'];
if($image1 == ''){
    $image1 = "images/blank.jpg";
}
?>

 

That way you leave the $image1 with it's original image path only if it is not empty, otherwise you'll show the blank.jpg. As for the alt attribute, you're assigning it the image path again, which shouldn't be normal . Probably an image description field in the db, or something like that could do the work.

 

EDIT: Was writting this while you posted the last message.