If statement connection

[Mekaboo]

Hey 😊

<?php
    require_once "db.php";
if(isset($_GET['image_id'])) && if(isset($_GET['comment'])) {
        $sql = "SELECT imageType,imageData FROM output_images WHERE imageId=" . $_GET['image_id'];
        $result = mysqli_query($conn, $sql) or die("<b>Error:</b> Problem on Retrieving Image BLOB<br/>" . mysqli_error($conn));
        $row = mysqli_fetch_array($result);
        header("Content-type: " . $row["imageType"]);
        echo $row["imageData"];
    }
      
    mysqli_close($conn);
?>

I added 'comment' column to the 'output_images' table and also added 'if(isset($_GET['comment']))' which works for the comment part but the images (imageId) now don't show.  I feel that I need to add '. $_GET['comment']' to the sql line but when I do it messes things up more. How to get both imageId and comment to work together?

[Ingolme]

The first thing you need to be aware of is that this file cannot display comments because you've set the content-type of the document as an image. The comment needs to be loaded in a different file.

Once you're writing code in a different file, you do not need $_GET['comment'] at all. The comment you're looking for is identified by which image it's attached to, which is why you only need the image's ID.

The code would be almost the same as the normal image code, but instead of selecting the image data, you're selecting the comment instead.

<?php
require_once "db.php";
if(isset($_GET['image_id'])) {
  
  // I'm adding this line because it's the bare minimum you need to prevent people from hacking your website with SQL injection.
  // You REALLY should be using prepared statements which are taught in the PHP tutorial.
  $_GET['image_id'] = (int) $_GET['image_id'];
  
  // In this query, we select the comment field, but use imageId in the WHERE clause.
  $sql = "SELECT comment FROM output_images WHERE imageId=" . $_GET['image_id'];
  
  // Get the result
  $result = mysqli_query($conn, $sql) or die("<b>Error:</b> Problem on Retrieving Image BLOB<br/>" . mysqli_error($conn));
  $row = mysqli_fetch_array($result);
  
  // Print the comment
  echo $row['comment'];
}
mysqli_close($conn);
?>