Using PHP to upload files into MySQL database sometimes needed by some web application. For instance for storing pdf documents or images to make som kind of online briefcase (like Yahoo briefcase).
For the first step, let's make the table for the upload files. The table will consist of.
- id : Unique id for each file
- name : File name
- type : File content type
- size : File size
- content : The file itself
For column content we'll use BLOB data type. BLOB is a binary large object that can hold a variable amount of data. MySQL have four BLOB data types, they are : - TINYBLOB
- BLOB
- MEDIUMBLOB
- LONGBLOB Since BLOB is limited to store up to 64 kilobytes of data we will use MEDIUMBLOB so we can store larger files ( up to 16 megabytes ).
An upload form must have encytype="multipart/form-data" otherwise it won't work at all. Of course the form method also need to be set to method="post". Also remember to put a hidden input MAX_FILE_SIZE before the file input. It's to restrict the size of files. After the form is submitted the we need to read the autoglobal $_FILES. In the example above the input name for the file is userfile so the content of $_FILES are like this : [color=144273]$_FILES['userfile']['name'][/color]
The original name of the file on the client machine. [color=144273]$_FILES['userfile']['type'][/color]
The mime type of the file, if the browser provided this information. An example would be "image/gif". [color=144273]$_FILES['userfile']['size'][/color]
The size, in bytes, of the uploaded file. [color=144273]$_FILES['userfile']['tmp_name'][/color]
The temporary filename of the file in which the uploaded file was stored on the server. [color=144273]$_FILES['userfile']['error'][/color]
The error code associated with this file upload. ['error'] was added in PHP 4.2.0
Before you do anything with the uploaded file. You should not assume that the file was uploaded successfully to the server. Always check to see if the file was successfully uploaded by looking at the file size. If it's larger than zero byte then we can assume that the file is uploaded successfully. PHP saves the uploaded file with a temporary name and save the name in [color=AC5668]$_FILES['userfile']['tmp_name'][/color]. Our next job is to read the content of this file and insert the content to database. Always make sure that you use [color=144273]addslashes()[/color] to escape the content. Using [color=144273]addslashes()[/color] to the file name is also recommended because you never know what the file name would be. That's it now you can upload your files to MySQL. Now it's time to write the script to download those files.
Downloading Files From MySQL Database
When we upload a file to database we also save the file type and length. These were not needed for uploading the files but is needed for downloading the files from the database. The download page list the file names stored in database. The names are printed as a url. The url would look like download.php?id=3. To see a working example click here. I saved several images in my database, you can try downloading them.
When you click the download link, the [color=144273]$_GET['id'][/color] will be set. We can use this id to identify which files to get from the database. Below is the code for downloading files from MySQL Database.
Before sending the file content using [color=144273]echo[/color] first we need to set several headers. They are : 1- header("Content-length: $size")
This header tells the browser how large the file is. Some browser need it to be able to download the file properly. Anyway it's a good manner telling how big the file is. That way anyone who download the file can predict how long the download will take. 2- header("Content-type: $type")
This header tells the browser what kind of file it tries to download. 3- header("Content-Disposition: attachment; filename=$name");
Tells the browser to save this downloaded file under the specified name. If you don't send this header the browser will try to save the file using the script's name (download.php).
After sending the file the script stops executing by calling exit. [color=FA0309]NOTE :[/color]
When sending headers the most common error message you will see is something like this : Warning: Cannot modify header information - headers already sent by (output started at C:\Webroot\library\config.php:7) in C:\Webroot\download.php on line 13 This error happens because some data was already sent before we send the header. As for the error message above it happens because i "accidentally" add one space right after the PHP closing tag ( ?> ) in config.php file. So if you see this error message when you're sending a header just make sure you don't have any data sent before calling [color=144273]header()[/color]. Check the file mentioned in the error message and go to the line number specified
- name : File name
- type : File content type
- size : File size
- content : The file itself
For column content we'll use BLOB data type. BLOB is a binary large object that can hold a variable amount of data. MySQL have four BLOB data types, they are : - TINYBLOB
- BLOB
- MEDIUMBLOB
- LONGBLOB Since BLOB is limited to store up to 64 kilobytes of data we will use MEDIUMBLOB so we can store larger files ( up to 16 megabytes ).
CREATE TABLE upload (
id INT NOT NULL AUTO_INCREMENT,
name VARCHAR(30) NOT NULL,
type VARCHAR(30) NOT NULL,
size INT NOT NULL,
content MEDIUMBLOB NOT NULL,
PRIMARY KEY(id)
);
Uploading a file to MySQL is a two step process. First you need to upload the file to the server then read the file and insert it to MySQL.
For uploading a file we need a form for the user to enter the file name or browse their computer and select a file. The input type="file" is used for that purpose.
id INT NOT NULL AUTO_INCREMENT,
name VARCHAR(30) NOT NULL,
type VARCHAR(30) NOT NULL,
size INT NOT NULL,
content MEDIUMBLOB NOT NULL,
PRIMARY KEY(id)
);
<form method="post" enctype="multipart/form-data">
<table width="350" border="0" cellpadding="1" cellspacing="1" class="box">
<tr>
<td width="246">
<input type="hidden" name="MAX_FILE_SIZE" value="2000000">
<input name="userfile" type="file" id="userfile">
</td>
<td width="80"><input name="upload" type="submit" class="box" id="upload" value=" Upload "></td>
</tr>
</table>
</form>
<table width="350" border="0" cellpadding="1" cellspacing="1" class="box">
<tr>
<td width="246">
<input type="hidden" name="MAX_FILE_SIZE" value="2000000">
<input name="userfile" type="file" id="userfile">
</td>
<td width="80"><input name="upload" type="submit" class="box" id="upload" value=" Upload "></td>
</tr>
</table>
</form>
An upload form must have encytype="multipart/form-data" otherwise it won't work at all. Of course the form method also need to be set to method="post". Also remember to put a hidden input MAX_FILE_SIZE before the file input. It's to restrict the size of files. After the form is submitted the we need to read the autoglobal $_FILES. In the example above the input name for the file is userfile so the content of $_FILES are like this : [color=144273]$_FILES['userfile']['name'][/color]
The original name of the file on the client machine. [color=144273]$_FILES['userfile']['type'][/color]
The mime type of the file, if the browser provided this information. An example would be "image/gif". [color=144273]$_FILES['userfile']['size'][/color]
The size, in bytes, of the uploaded file. [color=144273]$_FILES['userfile']['tmp_name'][/color]
The temporary filename of the file in which the uploaded file was stored on the server. [color=144273]$_FILES['userfile']['error'][/color]
The error code associated with this file upload. ['error'] was added in PHP 4.2.0
<?php
if(isset($_POST['upload']) && $_FILES['userfile']['size'] > 0)
{
$fileName = $_FILES['userfile']['name'];
$tmpName = $_FILES['userfile']['tmp_name'];
$fileSize = $_FILES['userfile']['size'];
$fileType = $_FILES['userfile']['type']; $fp = fopen($tmpName, 'r');
$content = fread($fp, filesize($tmpName));
$content = addslashes($content);
fclose($fp); if(!get_magic_quotes_gpc())
{
$fileName = addslashes($fileName);
} include 'library/config.php';
include 'library/opendb.php'; $query = "INSERT INTO upload (name, size, type, content ) ".
"VALUES ('$fileName', '$fileSize', '$fileType', '$content')"; mysql_query($query) or die('Error, query failed');
include 'library/closedb.php'; echo "<br>File $fileName uploaded<br>";
}
?>
if(isset($_POST['upload']) && $_FILES['userfile']['size'] > 0)
{
$fileName = $_FILES['userfile']['name'];
$tmpName = $_FILES['userfile']['tmp_name'];
$fileSize = $_FILES['userfile']['size'];
$fileType = $_FILES['userfile']['type']; $fp = fopen($tmpName, 'r');
$content = fread($fp, filesize($tmpName));
$content = addslashes($content);
fclose($fp); if(!get_magic_quotes_gpc())
{
$fileName = addslashes($fileName);
} include 'library/config.php';
include 'library/opendb.php'; $query = "INSERT INTO upload (name, size, type, content ) ".
"VALUES ('$fileName', '$fileSize', '$fileType', '$content')"; mysql_query($query) or die('Error, query failed');
include 'library/closedb.php'; echo "<br>File $fileName uploaded<br>";
}
?>
Before you do anything with the uploaded file. You should not assume that the file was uploaded successfully to the server. Always check to see if the file was successfully uploaded by looking at the file size. If it's larger than zero byte then we can assume that the file is uploaded successfully. PHP saves the uploaded file with a temporary name and save the name in [color=AC5668]$_FILES['userfile']['tmp_name'][/color]. Our next job is to read the content of this file and insert the content to database. Always make sure that you use [color=144273]addslashes()[/color] to escape the content. Using [color=144273]addslashes()[/color] to the file name is also recommended because you never know what the file name would be. That's it now you can upload your files to MySQL. Now it's time to write the script to download those files.
Downloading Files From MySQL Database
When we upload a file to database we also save the file type and length. These were not needed for uploading the files but is needed for downloading the files from the database. The download page list the file names stored in database. The names are printed as a url. The url would look like download.php?id=3. To see a working example click here. I saved several images in my database, you can try downloading them.
<html>
<head>
<title>Download File From MySQL</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head> <body>
<?php
include 'library/config.php';
include 'library/opendb.php'; $query = "SELECT id, name FROM upload";
$result = mysql_query($query) or die('Error, query failed');
if(mysql_num_rows($result) == 0)
{
echo "Database is empty <br>";
}
else
{
while(list($id, $name) = mysql_fetch_array($result))
{
?>
<a href="download.php?id=<?php=$id;?>"><?php=$name;?></a> <br>
<?php
}
}
include 'library/closedb.php';
?>
</body>
</html>
<head>
<title>Download File From MySQL</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head> <body>
<?php
include 'library/config.php';
include 'library/opendb.php'; $query = "SELECT id, name FROM upload";
$result = mysql_query($query) or die('Error, query failed');
if(mysql_num_rows($result) == 0)
{
echo "Database is empty <br>";
}
else
{
while(list($id, $name) = mysql_fetch_array($result))
{
?>
<a href="download.php?id=<?php=$id;?>"><?php=$name;?></a> <br>
<?php
}
}
include 'library/closedb.php';
?>
</body>
</html>
When you click the download link, the [color=144273]$_GET['id'][/color] will be set. We can use this id to identify which files to get from the database. Below is the code for downloading files from MySQL Database.
<?php
if(isset($_GET['id']))
{
// if id is set then get the file with the id from database include 'library/config.php';
include 'library/opendb.php';
$id = $_GET['id'];
$query = "SELECT name, type, size, content " .
"FROM upload WHERE id = '$id'"; $result = mysql_query($query) or die('Error, query failed');
list($name, $type, $size, $content) = mysql_fetch_array($result); header("Content-length: $size");
header("Content-type: $type");
header("Content-Disposition: attachment; filename=$name");
echo $content; include 'library/closedb.php';
exit;
} ?>
if(isset($_GET['id']))
{
// if id is set then get the file with the id from database include 'library/config.php';
include 'library/opendb.php';
$id = $_GET['id'];
$query = "SELECT name, type, size, content " .
"FROM upload WHERE id = '$id'"; $result = mysql_query($query) or die('Error, query failed');
list($name, $type, $size, $content) = mysql_fetch_array($result); header("Content-length: $size");
header("Content-type: $type");
header("Content-Disposition: attachment; filename=$name");
echo $content; include 'library/closedb.php';
exit;
} ?>
Before sending the file content using [color=144273]echo[/color] first we need to set several headers. They are : 1- header("Content-length: $size")
This header tells the browser how large the file is. Some browser need it to be able to download the file properly. Anyway it's a good manner telling how big the file is. That way anyone who download the file can predict how long the download will take. 2- header("Content-type: $type")
This header tells the browser what kind of file it tries to download. 3- header("Content-Disposition: attachment; filename=$name");
Tells the browser to save this downloaded file under the specified name. If you don't send this header the browser will try to save the file using the script's name (download.php).
After sending the file the script stops executing by calling exit. [color=FA0309]NOTE :[/color]
When sending headers the most common error message you will see is something like this : Warning: Cannot modify header information - headers already sent by (output started at C:\Webroot\library\config.php:7) in C:\Webroot\download.php on line 13 This error happens because some data was already sent before we send the header. As for the error message above it happens because i "accidentally" add one space right after the PHP closing tag ( ?> ) in config.php file. So if you see this error message when you're sending a header just make sure you don't have any data sent before calling [color=144273]header()[/color]. Check the file mentioned in the error message and go to the line number specified
