PHP - How To Get Blob Length/size.

I know the default length of a tiny int is less than an int, but if I put in the same length for both, are they essentially the same type?

Hi there,

How could I get the value of every 4 bytes of a BLOB? Additionally, how can I add an item to the end of a BLOB and store it back in the database?

Cheers,
George

Hi, I wonder whether someone may be able to help me please.

Through articles I've read on the Interent I've put together the code shown below which allows a user to upload, view and delete image files from a mySQL database.

Code: [Select]
if (!mysql_connect($db_host, $db_user, $db_pwd))
    die("Can't connect to database");

if (!mysql_select_db($database))
    die("Can't select database");

// This function makes usage of
// $_GET, $_POST, etc... variables
// completly safe in SQL queries
function sql_safe($s)
{
    if (get_magic_quotes_gpc())
        $s = stripslashes($s);
 
    return mysql_real_escape_string($s);
}
 
// If user pressed submit in one of the forms
if ($_SERVER['REQUEST_METHOD'] == 'POST')
{
    if (!isset($_POST["action"]))
    {
        // cleaning title field
        $title = trim(sql_safe($_POST['title']));
 
        if ($title == '') // if title is not set
            $title = '(No title provided';// use (empty title) string
 
        if (isset($_FILES['photo']))
        {
            @list(, , $imtype, ) = getimagesize($_FILES['photo']['tmp_name']);
            // Get image type.
            // We use @ to omit errors

            if ($imtype == 3) // cheking image type
                $ext="png";   // to use it later in HTTP headers
            elseif ($imtype == 2)
                $ext="jpeg";
            elseif ($imtype == 1)
                $ext="gif";
            else
                $msg = 'Error: unknown file format';
 
            if (!isset($msg)) // If there was no error
            {
                $data = file_get_contents($_FILES['photo']['tmp_name']);
                $data = mysql_real_escape_string($data);
                // Preparing data to be used in MySQL query
 
                mysql_query("INSERT INTO {$table}
                                SET ext='$ext', title='$title',
                                    data='$data'");
 
                $msg = 'Success: Image Uploaded';
            }
        }
        elseif (isset($_GET['title']))      // isset(..title) needed
            $msg = 'Error: file not loaded';// to make sure we've using
                                            // upload form, not form
                                            // for deletion

elseif($_FILES["fileupload"]["size"]/1024000 >= 10) // 10mb
{     
$msg = "<br />Your uploaded file size:<strong>[ ". $_FILES["fileupload"]["size"]/1024000  . " MB]</strong> is more than allowed 10MB Size.<br />";       
}

        if (isset($_POST['del'])) // If used selected some photo to delete
        {                         // in 'uploaded images form';
            $imageid = intval($_POST['del']);
            mysql_query("DELETE FROM {$table} WHERE imageid=$imageid");
            $msg = 'Photo deleted';
        }
 
        if (isset($_POST['view'])) // If used selected some photo to delete 
        { // in 'uploaded images form'; 
            $imageid = intval($_POST['view']); 
            mysql_query("SELECT ext, data FROM {$table} WHERE imageid=$imageid"); 
 
            if(mysql_num_rows($result) == 1) 
            { 
                $image = $row['myimage']; 
                header("Content-type: image/gif"); // or whatever 
                print $image; 
                exit; 
            } 
        } 
    }
    else
    {
        $imageid = intval($_POST['del']);
 
        if ($_POST["action"] == "view")
        {
            $result = mysql_query("SELECT ext, UNIX_TIMESTAMP(imagetime), data
                                     FROM {$table}
                                    WHERE imageid=$imageid LIMIT 1");
 
            if (mysql_num_rows($result) == 0)
                die('no image');
 
            list($ext, $imagetime, $data) = mysql_fetch_row($result);
 
            $send_304 = false;
            if (php_sapi_name() == 'apache') {
                // if our web server is apache
                // we get check HTTP
                // If-Modified-Since header
                // and do not send image
                // if there is a cached version
 
                $ar = apache_request_headers();
                if (isset($ar['If-Modified-Since']) && // If-Modified-Since should exists
                    ($ar['If-Modified-Since'] != '') && // not empty
                    (strtotime($ar['If-Modified-Since']) >= $imagetime)) // and grater than
                    $send_304 = true;                                     // imagetime
            }
 
            if ($send_304)
            {
                // Sending 304 response to browser
                // "Browser, your cached version of image is OK
                // we're not sending anything new to you"
                header('Last-Modified: '.gmdate('D, d M Y', $ts).' GMT', true, 304);
 
                exit(); // bye-bye
            }
 
            // outputing HTTP headers
            header('Content-Length: '.strlen($data));
            header("Content-type: image/{$ext}");
 
            // outputing image
            echo $data;
            exit();
        }
        else if ($_POST["action"] == "delete")
        {
            $imageid = intval($_POST['del']);
            mysql_query("DELETE FROM {$table} WHERE imageid=$imageid");
            $msg = 'Photo deleted';
        }
    }
}
?>

The problem I'm having is around the error message shown if the File Size is over the prescribed limit.

The part of the script that deals with this starts with the line: Code: [Select]
elseif($_FILES["fileupload"]["size"]/1024000 >= 10) // 10mb
Even though the file upload may fail because of the size of the file I receive the 'Error: unknown file format' message, and I'm not sure why.

I'm certainly no expert when it comes to PHP, so perhaps my lack of knowledge is letting me down.

But I just wondered if someone could perhaps take a look at this please and let me know where I'm going wrong.

Many thanks

Chris

Hi,

I have a MySQL database with BLOB data (MS Word files, Excel, PowerPoint, PDF etc.). I have a show_file function that assembles the blobs to send the file to the browser. It's been working great for a decade. Now, I am looking to filter the data against XSS vulnerabilities, much like I do with strings using htmlentities(). How do you go about doing that with BLOB data? I'm assuming htmlentities() will strip out characters from the BLOB data that will render the file unusable, correct? Here is my function:

function show_file( $fileID ) {
$nodeList = array();
$fileInfo = get_record( 'FileList', 'fileID', $fileID ) or trigger_error( 'Not a valid file ID: ' . $fileID );
// Pull list of inodes
$nodes    = get_recordset( 'FileData', 'fileID', $fileID, 'blobID' );
if ( !$nodes ) { trigger_error( 'Failure to retrieve file inodes: ' . mysql_error() ); }  
while ( $node = mysql_fetch_array( $nodes ) ) { $nodeList[] = $node['blobID']; }
// Send down the header to the client
if ( strpos( $_SERVER['HTTP_USER_AGENT'], 'MSIE' ) ) { header( 'Cache-Control: public' ); }
header( 'Content-Type: ' . $fileInfo['fileType'] );
header( 'Content-Length: ' . $fileInfo['fileSize'] );
header( 'Content-Disposition: attachment; filename=' . $fileInfo['fileName'] );
// Loop thru and stream the nodes 1 by 1
for ( $z = 0; $z < count( $nodeList ); $z++ ) {
$query = 'SELECT fileData FROM FileData WHERE blobID = ' . $nodeList[$z];
if ( $result = mysql_query( $query ) ) {
echo mysql_result( $result, 0 );
} else {
trigger_error( 'Failure to retrieve file node data: ' . mysql_error() );
}
}
}


So, I am looking to do something like echo mysql_result( htmlentities($result), 0 );

Thanks for any help you may provide,
George.

Hi I have create a script that adds a image as blob successfully,
however now I want to create a thumbnail, I have the following code; can someone help...

# open and code into blob
$fp = fopen($safename, 'r');
$content = fread($fp, filesize($safename));
$thumb = $content;
$content = addslashes($content);
fclose($fp);

# resize accordingly...
$thumb = new resize($content, $width, $height, 300);

# the class that does the resizing (WHERE I THINK ITS GONE WRONG)
class resize {
 public $new_image_blob = "";
 function __construct($blob, $width, $height, $amount) {
   
  # the maximum width and height as set by the user
  $thumb_height_max   = $amount;
  $thumb_width_max = $amount;
   
  # maintain aspect ratio landscape or portrait
  if($width < $height) {
   $new_width = ($thumb_height_max / $height) * $width;
   $new_height = $thumb_height_max;
   $needtoresize   = ($height < $thumb_height_max);
  } else {
   $new_width = $thumb_width_max;
   $new_height = ($thumb_width_max / $width) * $height;
   $needtoresize = ($width < $thumb_width_max);
  }   
   
  # now that we have the new width and heightwe need to resize the blob
  $im = imagecreatefromstring($blob);
  $thumb = imagecreatetruecolor($new_width, $new_height);
  imagecopyresampled($thumb, $im, 0, 0, 0, 0, $new_width, $new_height, ImageSX($im), ImageSY($im));
  $this->new_image_blob = addslashes($thumb);
 }
}

# then the query below adds the code (the original blob goes in correctly (ablob) but bblob (the resized blob doesn't))
$iS = "INSERT INTO $tableb (pal, afield, bfield, cfield, dfield, efield, ffield, gfield, ablob, bblob, cblob, dblob) VALUES
('6', '$fk', '$filename', '$size', '$fileExtension', '$width', '$height', '$orientation', '$content', '$thumb->new_image_blob', '$four', '$two')";