PHP: Does base64_encode protect from mysql injections? -

i'm trying set php page safely accept file upload (a resume), store mysql blob, , provide download later. when download pdfs later viewing, seem corrupted , won't open properly.

thanks question jgoettsch (php: reversing mysql_real_escape_string's effects on binary), realized feeding file data through mysql_real_escape_string (to prevent injection) might corrupt file contents, , got idea pass binary through base64_encode() instead, , use base64_decode() before download.

here's mockup code demonstrating i'm doing (which not working):

the upload:

<?  // file contents $cv_pointer = fopen($_files['cv']['tmp_name'], 'r'); $cv_content = fread($cv_pointer, filesize($_files['cv']['tmp_name'])); fclose($cv_pointer);  // insert sql $sql = sprintf("insert documents (name, file, size, date_uploaded)   values ('%s', '%s', '%s', now())",     mysql_real_escape_string($_files['cv']['name']),     mysql_real_escape_string($cv_content),     mysql_real_escape_string($_files['cv']['size'])); $result = mysql_query($sql); ?> 

and download:

<?  if (isset($_get['view_cv'])) {   $cv = mysql_fetch_assoc($rsapplicationcv);    header("content-length: ".$cv['size']);    header("content-type: application/pdf");    header("content-disposition: attachment; filename=".$cv['name']);   echo $cv['file'];   exit(); } ?> 

here questions:

1. if have file upload field, field vulnerable sql injection? or worrying unnecessarily? file upload task simpler if pass binary blob field without translations.
2. if feed uploaded file contents through base64_encode(), tantamount sanitization? or should encode additionally pass encoded string through mysql_real_escape_string?
3. this seems lot of effort store , fetch pdf. there simpler solution common need, haven't stumbled on yet?

thanks in advance!

q if have file upload field, field vulnerable sql injection?

a yes (sort of. it's not fields on form vulnerable sql injection; vulnerability in code handles values submitted in request.)

q or worrying unnecessarily?

a no. should aware of potential bad things happen, , write code in way prevents vulnerabilities being exposed (and exploited.)

q if feed uploaded file contents through base64_encode(), tantamount sanitization?

a it's there, long base64_encode guarantees returned value contain [a-za-z0-9+./=]. best practice use bind parameters

q or should encode additionally pass encoded string through mysql_real_escape_string?

a barring use of prepared statements bind parameters, best practice dictates values (including base64_encoded values) run through mysql_real_escape_string if being included in sql text submitted database.