6 replies to this topic

[dellee]

Can anybody tell me what is wrong with this code ? I want it to get the username from the database so it can be used in a VAR for naming the path to an image. The users registered name is the name of their images folder on my current site and I am adding in the ability to take a snapshot and upload it using photo_booth. There is a file in the photobooth script called "save.php" an the code tells the new photo where to go, I can get the new photo to go to any folder I want but I need it to have a VAR in it, the var would be the users registration name and is stored in the database and would have to be pulled from the database when the "save.php" page is called. So I guess what I need is to know how to have the username var present in the "save.php" file so it will create the string like this /images/$myVar/thumbnail.jpg instead of /images/Tina/thumbnail.jpg Here is the code and it does not work, lol. Any insight or help would be great, I am pretty new to this. Obviously something is not correct, I just assumed the save.php file would call to the database and grab the logged in users name.

save.php

<?php


include("../dbase.php");


$result=mysql_query("SELECT user from $_COOKIE[usertype] WHERE id='$_COOKIE[id]' LIMIT 1");




	while($row = mysql_fetch_array($result)) 


	{	$username=$row['user'];	}



if(isset($GLOBALS["HTTP_RAW_POST_DATA"])){

	$jpg = $GLOBALS["HTTP_RAW_POST_DATA"];

	$img = $_GET["img"];

///////////the var $username is not working///////////////

	$filename = "../models/$username/thumbnail.jpg";

	file_put_contents($filename, $jpg);

} else{

	echo "Encoded JPEG information not received.";

}

?>

Thanks for any help, I know new people suck :rolleyes:

[John]

mysql_fetch_row()

[dellee]

Thanks for the reply, is that simply the only thing missing? Any chance you could show me where to place that in the code? If so I would be forever grateful :rolleyes:

[bbqroast]

When using $_GET[] make sure you use 's like $_GET['stuff'] also you really should sanitize, other wise with a firefox addon and the click of a button I could gain privileges equal to those that you use to log in with in the script.

[dellee]

Hey thanks for the insight, I just Googled how to sanitize PHP, sorry I am new but the sanitize seems like something I should keep a huge focus on while writing any code with input. Thank you, this little tip may have saved me a lot of time later. Thanks again. :thumbup1:

[bbqroast]

Yeah,
I have ditched so many projects because it becomes to difficult to implement it afterwards :(.

[dellee]

You mention a Firefox plugin, is that something I could use to test my code? Just something to see if it is secure? I am not familiar with that plugin or where to get it.