Member Avatar for rjusman90 
<?php

$User_ID=$_SESSION['UserId'];
$query = mysql_query("SELECT * FROM Users WHERE UserId='$User_ID'");
$row = mysql_fetch_array($query);
$filename=$row['PicUrl'];
if(isset($_SESSION["UserName"])){?>

        <img src="images/<?php echo $filename?>"  align="left"width="50px" height="50px"/> <?php echo $_SESSION["UserName"];
echo"<li><a href='logout.php'>Click here to Logout.</a></li>";
echo"<li><a href='user_update.php'>edit your account detail</li>";
}

?>

if pic url is empty then hide img scr

  • 2 Contributors
  • 2 Replies
  • 220 Views
  • 2 Hours Discussion Span
  • Latest Post Latest Post by rjusman90

Dani AI

Generated

Short answer: only output the <img> tag when the DB field contains a filename and the file actually exists. 's conditional is the right idea for a quick fix, but for production you should also stop using mysql_*, validate the filename, check the file on disk, and escape output to avoid XSS. , the code in your first post uses deprecated functions and prints user data without sanitizing.

A practical checklist: use PDO or mysqli with prepared statements to fetch PicUrl and UserName; sanitize the filename with basename() and check is_file() (or is_readable()); escape the displayed username with htmlspecialchars(); build the src using rawurlencode(); and optionally append ?v=filemtime() to bust caches. If the file is missing, either echo nothing (hide the tag) or output a default avatar. Also prefer CSS for sizing/styling instead of width="50px".

Example (safe, different from earlier snippets):

<?php
// session_start() and $pdo (PDO) must be set up earlier
$userId = $_SESSION['UserId'] ?? null;
if ($userId) {
    $stmt = $pdo->prepare('SELECT PicUrl, UserName FROM Users WHERE UserId = :id LIMIT 1');
    $stmt->execute([':id' => $userId]);
    $row = $stmt->fetch(PDO::FETCH_ASSOC);
    $pic = $row['PicUrl'] ?? '';
    $name = $row['UserName'] ?? '';
    $safeName = htmlspecialchars($name, ENT_QUOTES, 'UTF-8');

    if ($pic) {
        $file = __DIR__ . '/images/' . basename($pic);
        if (is_file($file) && is_readable($file)) {
            $src = 'images/' . rawurlencode(basename($pic)) . '?v=' . filemtime($file);
            echo '<img class="avatar" src="' . $src . '" alt="' . $safeName . '" width="50" height="50">';
        }
        // else: no img tag (or echo a default image)
    }

    echo $safeName;
}
?>

Extra tips: store uploaded filenames as generated hashes, validate upload MIME types, set tight file permissions, and keep layout stable with a placeholder or CSS when you choose not to render an image.

Recommended Answers

All 2 Replies

Member Avatar for davecoventry 
if(!empty($filename)){echo '<img src="images/'.$filename.'"  align="left"width="50px" height="50px"/>';}
Member Avatar for rjusman90

thnx alot

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.