[Skidy]

I can't find any recent tutorials on how I would do this. How would I upload an image to say a database and display it to the webpage securily in PHP?

[gua]

Alex from php academy have some video tutorials on thenewboston channel about that if i remember good.. Videos are from 2011 but i think you should watch it and than check in php manual if functions and methods that he use are still good and secure nowdays, i will try to make similar project like he did there, but i am not planing to make it soon because i dont want to start with db's yet.. I can't post link now because i am on my phone but i will send it to you later, also if you find some nice tut that is "fresh" please share with us 👍

[mothh]

Alex from php academy have some video tutorials on thenewboston channel about that if i remember good.. Videos are from 2011 but i think you should watch it and than check in php manual if functions and methods that he use are still good and secure nowdays, i will try to make similar project like he did there, but i am not planing to make it soon because i dont want to start with db's yet.. I can't post link now because i am on my phone but i will send it to you later, also if you find some nice tut that is "fresh" please share with us 👍

PHPAcademy is indeed a good channel.

[noname1]

now called CodeCourse

https://www.youtube.com/watch?v=bfD51iRTAXU

[False King]

Don't upload an image into a database. Upload the file on your server, and store the name. As for making sure they don't upload anything that isn't a image, you could check on the extension. However even this might not be fully save, I do have a piece of code I used a while back. I don't say this is the best way, but it is an option. Note: this is taken from something I made for myself, so this won't work by just copy/paste. Don't ask me how to get it working, just take the information out of the code.

Code

public function newImage($image) {
        if ($image["error"] === 0) {
            $data    = file_get_contents($image["tmp_name"]);
            $gdImage = @imageCreateFromString($data);
            
            if ($gdImage) {
                $scaledImage = $this->scaleImage($gdImage, 1920, 250);
                imageDestroy($gdImage);
                
                $filename = time().sha1_file($image["tmp_name"]).".png";
                $target   = "assets/uploads/headers/" . $filename;
                
                if (!imagePNG($scaledImage, $target)) {
                    return false;
                }
                imageDestroy($scaledImage);
                unlink($image["tmp_name"]);
                      
                return $filename;
            } else {
                return false;
            }
        } else {
            return false;
        }
    }
    
    function scaleImage($imageHandle, $maxWidth, $maxHeight) {
        $originalWidth  = $width  = imageSX($imageHandle);
        $originalHeight = $height = imageSY($imageHandle);
        
        if($height > $maxHeight) {
            $width  = (($maxHeight / $height) * $width);
            $height = $maxHeight;
        }
        
        if($width > $maxWidth) {
            $height = (($maxWidth / $width) * $height);
            $width  = $maxWidth;
        }
        
        $image = imageCreateTrueColor($width, $height);
        imageAlphaBlending($image, false);
        imageSaveAlpha($image, true);
        
        imageCopyResampled($image, $imageHandle, 0, 0, 0, 0, $width, $height, $originalWidth, $originalHeight);
        
        return $image;
    }

[MineSQL]

Essentially, just ensure the file type is valid, ensure that the uploaded directory is not accessible by the public (outside Web root or permissions), and ensure the file isn't directly accessed, and rather fetched in php and then the headers are modified to mimic a direct link.

Of course, some of these things don't have to be used to ensure moderate security, but by using all the precautions it seriously limits vulnerabilities. Especially with files, as a whole slew of factors come into play when handling them properly compared to a text input.