Thread: inserting a file into a database.

inserting a file into a database.

From
"Christopher Smith"
Date:

Hi all,

I'm trying to insert a file into a database from a php form. Here's my sql
statement..

$sql="insert into scripts (id, submittedby, description, script, scriptfile)
values (nextval('scripts_id_seq'), '$loginname', '$description', '$script',
lo_import('$userfile'))";

Here's the error I get..

Warning: PostgresSQL query failed: ERROR: You must have Postgres superuser
privilege to use server-side lo_import(). Anyone can use the client-side
lo_import() provided by libpq. in put-file.php on line 4

OK, I understand the error, no problems. How do I fix it? How do I get around
it? Anyone have a better solution for the sql statement? I don't want to use
libpq, I wanted to be able to do it with php. My webserver runs as "wwwrun", my
postgres superuser is "postgres".

Here's my permission table..

xxxx=# \z
Access permissions for database "xxxx"
     Relation     | Access permissions
------------------+---------------------
 scripts          | {"=","wwwrun=arwR"}
 scripts_id_seq   | {"=","wwwrun=arwR"}

If anyone has some suggestions, please let me know.

Thanks,
Chris.




This email message and any accompanying attachments may contain information that
is confidential and subject to legal privilege.  If you are not the intended
recipient, do not read, use, disseminate, distribute or copy this message or
attachments.  If you have received this message in error, please notify the
sender immediately and delete this message.  Any views expressed in this message
are those of the individual sender, except where the sender expressly, and with
authority, states them to be the views of AMP/GIO.  Before opening any
attachments, please check them for viruses and defects.



Re: inserting a file into a database.

From
Claus Houmøller
Date:
Hi,

You can use the pg_lo* functions in php4 (I think these functions are
implemented using libpq, and therefore there are no problems with
permissions). First you have to open your file for reading, then create
a large object id, create a large object file pointer (for writing),
write data to the object fp, and finaly do an 'insert' with the given
oid. All this has to be done in a single pgsql transaction, like:

...
$fp = fopen("/tmp/ferrari.jpg", "r");
pg_exec($db_conn, "begin");
$loid = pg_locreate($db_conn);
$lofp = pg_loopen($db_conn, $loid, "w");
while( $nbytes = fread($fp, BUFSIZE) )
{
        $tmp = pg_lowrite($lofp, $nbytes);
        if( $tmp < $nbytes )
                echo "error while writing large object";
}
pg_exec($db_conn, "insert into car values(nextval('car_id_seq'), " .
$loid . ")";
pg_loclose($lofp);
pg_exec($db_conn, "commit");
fclose($fp);
...

...that works for me..

regards,

Claus Houmøller

Christopher Smith wrote:
>
> Hi all,
>
> I'm trying to insert a file into a database from a php form. Here's my sql
> statement..
>
> $sql="insert into scripts (id, submittedby, description, script, scriptfile)
> values (nextval('scripts_id_seq'), '$loginname', '$description', '$script',
> lo_import('$userfile'))";
>
> Here's the error I get..
>
> Warning: PostgresSQL query failed: ERROR: You must have Postgres superuser
> privilege to use server-side lo_import(). Anyone can use the client-side
> lo_import() provided by libpq. in put-file.php on line 4
>
> OK, I understand the error, no problems. How do I fix it? How do I get around
> it? Anyone have a better solution for the sql statement? I don't want to use
> libpq, I wanted to be able to do it with php. My webserver runs as "wwwrun", my
> postgres superuser is "postgres".
>
> Here's my permission table..
>
> xxxx=# \z
> Access permissions for database "xxxx"
>      Relation     | Access permissions
> ------------------+---------------------
>  scripts          | {"=","wwwrun=arwR"}
>  scripts_id_seq   | {"=","wwwrun=arwR"}
>
> If anyone has some suggestions, please let me know.
>
> Thanks,
> Chris.
>
> This email message and any accompanying attachments may contain information that
> is confidential and subject to legal privilege.  If you are not the intended
> recipient, do not read, use, disseminate, distribute or copy this message or
> attachments.  If you have received this message in error, please notify the
> sender immediately and delete this message.  Any views expressed in this message
> are those of the individual sender, except where the sender expressly, and with
> authority, states them to be the views of AMP/GIO.  Before opening any
> attachments, please check them for viruses and defects.