Profile pic feature for my login script - NO CODES NEEDED

[begamer26]

Okay I have succesfully created a login/register/accountpage php script but now I want to add onto that and create a feature that allows you to create a profile picture and keep it as YOUR profile picture. I dont need any codes as I will create the myself for the sake of learning but if you need to, to explain then thats fine

Im using WAMP for now so every feature on here is on there and im using HTML, PHP, MYSQL out of them

[supajason]

What do you mean by create a profile picture?

Do you mean; the user makes(draws lines, circles etc) the picture on your site or the user can upload the picture from there computer or a URL?

[begamer26]

What do you mean by create a profile picture?

Do you mean; the user makes(draws lines, circles etc) the picture on your site or the user can upload the picture from there computer or a URL?

From there computer!

[diabolo]

well here is the basic of it:

1| upload script
11| check for valid file type / file size
12| where to store the files
13| how to make the relation
2| database to store the relation of user to their picture

[begamer26]

Okay I can upload the file, write the directory into the database but I cant get it to display it? heres a selection of my code, tell me whats wrong please -

        <table width="130" border="1">
          <tr>
            <td height="130"><img src="
   <?php
			  $COOKIE=$_COOKIE['username'];
$con = mysql_connect("localhost","root","");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }
mysql_select_db("begamer", $con);
$result = mysql_query("SELECT profilepic FROM users
WHERE username='$COOKIE';");
while($row = mysql_fetch_array($result))
  {
  $row['profilepic'];
  }
?> " width="100%" height="100%"></td>
          </tr>
        </table>

[begamer26]

No Worry's I fugured it out! 8P I was using an un-needed loop

<?php
     $COOKIE=$_COOKIE['username'];
$con = mysql_connect("localhost","root","");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }
mysql_select_db("begamer", $con);
$result = mysql_query("SELECT profilepic FROM users
WHERE username='$COOKIE';");
$row = mysql_fetch_array($result);
echo($row['profilepic']);
?>

[misson]

Your script is open to SQL injection. Switch to using PDO and prepared statements. The DB connection should be placed in a function to isolate DB user credentials and improve reliability and security. Read "Writing MySQL Scripts with PHP and PDO" for more.

[begamer26]

Your script is open to SQL injection. Switch to using PDO and prepared statements. The DB connection should be placed in a function to isolate DB user credentials and improve reliability and security. Read "Writing MySQL Scripts with PHP and PDO" for more.

Thank's, Ive already protected my login script from mysql injection but forgot to add it t this script XP

[misson]

forgot to add it t this script

Exactly why prepared statement parameters are so useful. If you use them, there's nothing to forget, security-wise.