spaces in a directory

[guitaristmike]

When i show a photo in a directory that does not contain spaces, the photo displays fine. But if i show a photo in a directory that is, for example: 2002 Banquet Awards the photo will not display.

here's my code...

<!--SHOW ALBUM -->
<table align="center">
<tr><td>
<table align="center" id="showUsers">
<!-- Add div tage here for a header -->
<div id="showUsersHeader"> <?php echo $_GET['album']?> </div>

<tr>
<td>
<?php
while($row= mysql_fetch_array($r)) {
?>
<?php
echo '<a href=""> ';?>
<?php echo "<img onmouseover=\"this.style.borderColor='2F3868'\" onmouseout=\"this.style.borderColor='silver'\" style='border:1px solid silver;' width=100 height=75 src=../../photogallery/". $row['album'] ."/".$row['photo'] .">";?>

</a>
<?php }
?>
</td>
</tr>

</table>
</td></tr>
</table>

When i viewsource, the image is in there. it's just not displaying...

<img onmouseover="this.style.borderColor='2F3868'" onmouseout="this.style.borderColor='silver'" style='border:1px solid silver;' width=100 height=75 src=../../photogallery/2002 Awards Banquet/banquet1.jpg>

If the directory was this:
src=../../photogallery/Awards/banquet1.jpg> it would show.

What can i do?

[PHP_Chimp]

That will be because when you put 'something else' into the browser it gets encoded to 'something%20else'. So calling 'something else' will fail as in the file system you have 'something%20else'.
You could make sure that if people entered a space in a file name that this is converted to _ or whatever other character you want.

str_replace [uk3.php.net]
could be used to change ' ' into '_'. This would then stop your problem with url encoded spaces.

[eelixduppy]

You can also use urldecode [us2.php.net] as well to get the original string again. Spaces in names always cause a problem and you should stay away from doing that if you can.

As a side note, it's generally not a good idea to allow users to name their own files; you should be giving them your own names.

[eelixduppy]

oh, and Welcome to WebmasterWorld! :)

[pinterface]

To understand why this isn't working for you, let's start with a simple example and work our way up to something more interesting. Understanding why images with spaces don't work requires understanding how a browser parses HTML.

Given

echo "<img src=$file x=y>";

, what happens as $file changes?

$file = "ham";

=>

<img src=ham x=y>

The browser sees an <img> tag, and two attributes, "src" with a value of "ham" and "x" with a value of "y".

$file = "mighty ducks";

=>

<img src=mighty ducks x=y>

Here, the browser sees an <img> tag, and three attributes. "src" with a value of "mighty", "ducks" with a value of "ducks" (any attribute with no value specified takes its own name as its value), and "x" with a value of "y".

The browser cannot automatically determine which spaces should separate attribute-value pairs and which spaces should not. To see an example of why, consider the following.

$file = "ham width=10 height=20";

=>

<img src=ham width=10 height=20 x=y>

Now, is this an image with a filename of "ham width=10 height=20" or an image with a filename of "ham", a width of 10, and height of 20? You might know because you wrote it, but the browser can't tell the difference.

$file = "ham>Greetings!<img";

=>

<img src=ham>Greetings!<img x=y>

What about this case? Is the file pathologically named, or are there two images with the word "Greetings!" in between? How would a browser tell the difference?

How to solve this problem? Fortunately, HTML [w3.org] provides the option of quoting attribute values, so if we change our original code fragment to:

echo "<img src=[b]'[/b]$file[b]'[/b] x=y>";

We end up with the following, instead:

$file = "ham";

=>

<img src='ham' x=y>

$file = "mighty ducks";

=>

<img src='mighty ducks' x=y>

$file = "ham width=10 height=20";

=>

<img src='ham width=10 height=20' x=y>

$file = "ham>Greetings!<img";

=>

<img src='ham>Greetings!<img' x=y>

It's only fair I warn you this still doesn't fully solve your problem--you'd still be just as open to various security vulnerabilities (XSS attacks and so forth) as you are now--but hopefully it brings you closer to understanding why what you are doing is wrong and how to fix it.

You would do well to peruse the HTML specification [w3.org] and to read up on Cross-Site Scripting vulnerabilities, often referred to as XSS.

You would also do well to heed eelixduppy's advice:

it's generally not a good idea to allow users to name their own file

For instance, imagine the file is named "..\..\..\..\..\..\..\Windows\important-system-file.exe", or "../../../../../../../etc/passwd". Bad things happen when you trust user data.