diff --git a/.DS_Store b/.DS_Store
index 40f23c0b3a8913a76feca893a725e8b681092e80..1b0e4736f01e3d6317579347a6a9479fa62c2adb 100644
Binary files a/.DS_Store and b/.DS_Store differ
diff --git a/Lab4/__pycache__/database_helper.cpython-310.pyc b/Lab4/__pycache__/database_helper.cpython-310.pyc
index a7b3a71ef7e07d53e9b9585d768829f3334af8a7..39a86975cf1d2709547c7edc3fcfc7d630ba111c 100644
Binary files a/Lab4/__pycache__/database_helper.cpython-310.pyc and b/Lab4/__pycache__/database_helper.cpython-310.pyc differ
diff --git a/Lab4/__pycache__/server.cpython-310.pyc b/Lab4/__pycache__/server.cpython-310.pyc
index 2cc597e387266ffca36168fa028eebe07feb0aae..32747256fc1acb196f39de31516988c4e65704be 100644
Binary files a/Lab4/__pycache__/server.cpython-310.pyc and b/Lab4/__pycache__/server.cpython-310.pyc differ
diff --git a/Lab4/database.db b/Lab4/database.db
index 471b6efb45665868a93ae16e837781bf857a1bf6..7fd372c02c76c6a5d6a8824bc576312f87bdef86 100644
Binary files a/Lab4/database.db and b/Lab4/database.db differ
diff --git a/Lab4/database_helper.py b/Lab4/database_helper.py
index 76a3cf7e796fe5f89d12a5203e44363e9eccbd40..2e52d2f10967c104be861b9067c90d8ff74afe04 100644
--- a/Lab4/database_helper.py
+++ b/Lab4/database_helper.py
@@ -31,14 +31,6 @@ def authenticate(email, password):
         return False
 
 
-"""def addToLoggedInUsers(token, email):
-    try:
-        get_db().execute("INSERT into LOGGEDINUSERS values(?, ?)", [token, email])
-        get_db().commit()
-        return True
-    except:
-        return False"""
-
 def addToLoggedInUsers(token, email):
     try:
         db = get_db()
@@ -123,6 +115,44 @@ def get_data_email(email):
     except:
         return None
 
+def add_picture_to_db(image, email):
+    try:
+        cursor = get_db().cursor()
+        cursor.execute("SELECT EMAIL FROM PICTURES WHERE EMAIL=?", [email])
+        exists = cursor.fetchone()
+        if exists:
+            cursor.execute("UPDATE PICTURES SET IMAGE=? WHERE EMAIL=?", (image, email))
+            get_db().commit()
+            return True
+        else:
+            sql_insert_query = """INSERT INTO PICTURES (email, image)
+                                       VALUES (?, ?)"""
+            record_to_insert = (email, image)
+            get_db().execute(sql_insert_query, record_to_insert)
+            get_db().commit()
+            return True
+    except:
+        return False
+
+
+def get_picture_from_db(email):
+    try:
+        cursor = get_db().cursor()
+        cursor.execute("SELECT EMAIL FROM PICTURES WHERE EMAIL=?", [email])
+        exists = cursor.fetchone()
+        #the user has a profile picture
+        if exists:
+            cursor.execute("SELECT image FROM PICTURES WHERE EMAIL=?", [email])
+            image_data = cursor.fetchone()[0]
+            if image_data:
+                return image_data
+            return False
+        #the user doesn't have profile picture
+        else:
+            return 1
+    except:
+        return False
+
 
 def get_messages_email(email):
     try:
@@ -153,7 +183,7 @@ def change_password(email, newpassword):
 
 def check_email_exists(email):
     cursor = get_db().cursor()
-    cursor.execute("SELECT email FROM USERS WHERE email=?", (email,))
+    cursor.execute("SELECT email FROM USERS WHERE email=?", [email])
     result = cursor.fetchone()
     return True if result else False
 
diff --git a/Lab4/schema.sql b/Lab4/schema.sql
index 3ad2fecf000595858432d2798aba367755d00288..570f6a8432e13d2ff21ead2eac0862f563aef483 100644
--- a/Lab4/schema.sql
+++ b/Lab4/schema.sql
@@ -21,4 +21,10 @@ CREATE TABLE MESSAGES(
   EMAIL_SENDER VARCHAR(30)  NOT NULL,  --Celui qui envoie le mail
   MESSAGE TEXT  NOT NULL,
   PRIMARY KEY(id AUTOINCREMENT)
-);
\ No newline at end of file
+);
+
+
+CREATE TABLE PICTURES (
+  EMAIL VARCHAR(255) NOT NULL,
+  IMAGE BLOB
+);
diff --git a/Lab4/server.py b/Lab4/server.py
index 4a46b7fe7c53c10b981e3fef551059e882fd3079..c915e2314368c31391893cb1615e4dab4b8c3def 100644
--- a/Lab4/server.py
+++ b/Lab4/server.py
@@ -7,6 +7,7 @@ import random
 import string
 import json
 import re
+import io
 
 app = Flask(__name__, template_folder='static')
 sockets = Sock(app)
@@ -223,6 +224,25 @@ def post_message():
         return "", 400
 
 
+@app.route("/users/account/changepp", methods = ['POST'])
+def upload_image():
+    image_file = request.files.get('image')
+    image_data = image_file.read()
+    email = request.form.get('email')
+    if database_helper.add_picture_to_db(image_data, email):
+        return "", 201
+    return "", 400
+
+@app.route("/users/account/getpp/<email>", methods = ['GET'])
+def get_image(email):
+    image = database_helper.get_picture_from_db(email)
+    if image == 1:
+        return "", 204
+    elif image != False:
+        return image, 200
+    else:
+        return "", 400
+
 def get_token_from_header():
     try:
         token = request.headers['token']
diff --git a/Lab4/static/client.css b/Lab4/static/client.css
index 5fb795e34ff69e51ba3a5fcd9e65ff24a04839b4..340dedfac6308a89436d7e28a4e2753f1d891836 100644
--- a/Lab4/static/client.css
+++ b/Lab4/static/client.css
@@ -333,7 +333,7 @@ img {
 }
 
 #drop-zone.hover {
-  border-color: red;
+  border-color: black;
 }
 
 
diff --git a/Lab4/static/client.js b/Lab4/static/client.js
index 25529f7dd64a29905f3d1905ca799fcfe17a6b5a..3bf22126ce679293c07619adb5f5eb8b334b2c69 100644
--- a/Lab4/static/client.js
+++ b/Lab4/static/client.js
@@ -342,7 +342,7 @@ function openTab(tabName) {
 
   if(tabName == "accountPage") {
     document.getElementById("pflegend").innerHTML = localStorage.getItem("reloadHome");
-    //document.getElementById("profile-image").src = dbimage;
+    load_profilepicture();
   }
 }
 
@@ -493,7 +493,7 @@ function fills_data(tab, data_user) {
 
 
 
-//---------------------------------------------------------------------------------------//
+//------------------------------DRAG AND DROP----------------------------------//
 
 
 function dragOver(e) {
@@ -510,12 +510,45 @@ function drop(e) {
   e.preventDefault();
   document.getElementById("drop-zone").classList.remove("hover");
   var files = e.dataTransfer.files;
-  for (var i = 0; i < files.length; i++) {
-    var file = files[i];
+  var file = files[0];
+  
+  if (file.type.endsWith('png') || file.type.endsWith('jpeg')) {
+    const formData = new FormData();
+    formData.append('image', file);
+    formData.append('email', localStorage.getItem('reloadHome'));
+
+    //send the picture and the email to the DB
+    post_picture(formData);
+
+    //modify the picture profile on the actual page to avoid refreshing the page
     var reader = new FileReader();
     reader.onload = function(e) {
       document.getElementById("profile-image").src = e.target.result;
     };
     reader.readAsDataURL(file);
+  } else {
+    alert('Please drop a PNG or JPEG file.');
   }
+
+}
+
+function post_picture(form) {
+  let req = new XMLHttpRequest();
+  req.open("POST", "/users/account/changepp", true);
+  req.send(form);
+}
+
+function load_profilepicture() {
+  var xhr = new XMLHttpRequest();
+  xhr.open('GET', '/users/account/getpp/' + localStorage.getItem('reloadHome'));
+  xhr.responseType = 'blob';
+  xhr.onload = function() {
+    if (xhr.status === 200) {
+      // Create a new image object from the blob data
+      var blob = xhr.response;
+      var img = document.getElementById("profile-image");
+      img.src = window.URL.createObjectURL(blob);
+    }
+  };
+  xhr.send();
 }