0

I want to know what could be the potential risk with the displaying part of this behavior.

For the upload part:

  1. A form with a file upload for image.

  2. Image content is save into Mysql "longBlob" type (It is a requirement)

For the display (loadImage.php):

  1. A script loadImage.php will receive as parameter the record id.

  2. It Will set the proper image header

  3. It will echo the longBlog content

The image will be load like this: src="loadImage.php?id=%i".

Improve this question

2 Answers 2

Reset to default
2

Apart from it being an inefficient way to store an image, storing the image in a database isn't any riskier than storing it on the filesystem.

The major difference between the two is that filesystem storage is vulnerable to directory-traversal attacks, where database storage is vulnerable to SQL injection attacks.

Improve this answer
1
  • Ok thank, but I more aware about the "displaying part" the possible xss inject that could be store in the image...
    – Frederic Nault
    Commented Sep 19, 2014 at 9:31
1

How are you generating the record ids? If they are incremental, I could retrieve all of your images in a breeze… (but as I don't know what are those images for, perhaps you don't care 😉)

Improve this answer
1
  • Indeed the ids are incremental but we do not need access restriction for the images.
    – Frederic Nault
    Commented Sep 27, 2014 at 13:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .