php insert blob into mysql from base64 string

Question

I knew that there are several similar questions, also I am aware that best practice is to keep images on server but I was told to do this way... Well I am sending base64 string from android to php webservice. I am sending it right, also tested via Postman to be sure that problem is not android but service. I have error: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'oX?ë–§?=j?b?ED?NÏ¯??=?|?pv??Ñ‘Qv}gX?' at line 2

<?php
header('Content-Type: text/html; charset=utf-8');

// array for JSON response
$response = array();

// include db connect class
    require_once '../config/db_connect.php';

    $db = new DB_CONNECT();

    $host_id = $_POST['host_id'];
    $name = $_POST['event_name'];
    $description = $_POST['event_description'];
    $date = $_POST['date'];
    $photo = $_POST['photo'];
    // get all products from products table
    $escaped = mysql_escape_string ($photo);
    $photo_blob = base64_decode($escaped);

    //echo $photo_blob;

    $result = mysql_query(
    'INSERT INTO dogadjaj (host_id, name, description, date, photo) 
    VALUES ("' . $host_id . '" ,"' . $name .'", "' . $description . '", "' . $date . '", "' . $photo_blob . '");')
    or die(mysql_error());

?>

First, stop using the mysql_* functions. They've been deprecated for a long time and removed in PHP7. Second, learn about prepared statements. You are currently vulnerable to SQL injection. Third, why would you run mysql_escape_string() before base64_decode()? — Patrick Q
– Patrick Q, Commented Oct 20, 2017 at 17:14
You would use base64_encode(); not base64_decode(); to generate a base64 encoded string. — John B. Walugembe
– John B. Walugembe, Commented Oct 20, 2017 at 18:41
@JohnB.Walugembe, ouch. I don't knew why I put that.... That was answer. :) Many thanks!!! — Darman
– Darman, Commented Oct 21, 2017 at 7:01
Ok thanks, I had deleted the full answer and used a comment because I was not sure. I have now undeleted the answer. — John B. Walugembe
– John B. Walugembe, Commented Oct 21, 2017 at 7:07

John B. Walugembe · Accepted Answer · 2017-10-21 07:13:11Z

1

Use $photo_blob = base64_encode($escaped); instead of $photo_blob = base64_decode($escaped);. You would need the base64_decode when processing the base_64 read from the database.

edited Oct 21, 2017 at 7:13

answered Oct 20, 2017 at 18:18

John B. Walugembe

5894 silver badges12 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

php insert blob into mysql from base64 string

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related