imagepng() -> MySQL BLOB

[Kryptix]

I have created a image using imagepng() and then right-click'd and saved it. I then added it to the database by using phpMyAdmin to upload it directly into a field called 'avatar' which is a BLOB. The code the view the image back is the following:

 

header("Content-type: image/png");
echo mysql_result(mysql_query("SELECT `avatar` FROM `rscd_players` WHERE `username` = 'Kryptix'"), 0);

 

Now when I try and add the imagepng() directly to the database it doesn't work. I've tried multiple things. Here's the code:

 

ob_start(); imagepng($char_image); $pngimagedata = ob_get_contents(); ob_end_clean();

mysql_query("UPDATE `rscd_players` SET `avatar` = " . $pngimagedata . " WHERE `username` = 'Kryptix'");

 

Here's the full code: http://pastebin.com/jqsKc9Qd

 

This is the query that phpMyAdmin produces: http://pastebin.com/nuypNuwJ

 

This is the query that the above code produces: http://pastebin.com/NPWmi5eb

 

phpMyAdmin is 2.2kB, my code is 4.4kB

 

Any idea? I've been trying all night...

[PFMaBiSmAd]

The only thing that is apparent, is that you need to escape the data before you put it into the query statement.

 

It would help if you defined: it doesn't work?

[requinix]

$pngimagedata is raw, binary data. You can't insert it into a text query and expect it to work. What if the binary data contains quotes? Valid SQL statements? It's like some rocket scientist explaining propulsion to a layman: he might follow along for a second or two, but he'll get confused very fast, and he might even misinterpret something because it sounded familiar.

 

You should use mysqli or PDO instead of the plain mysql extension, but if you're stuck with it then use mysql_real_escape_string on $pngimagedata. Just like you would with form inputs. Because in the end it's all untrusted data.

[Kryptix]

Solved thanks.