Linking to Images in DB

Anon

Hi,

Question about linking to images:

I'm building a site that allows uploading of images. I'll be putting them in a MySQL database, and accessing them through something like www.mysite.com/getimage.php?image=myimage

I'm fine with how to do this, BUT I'd like to do one other thing. I don't want people to link directly to my images from their sites, as I pay for my own bandwidth, and it's just a hobby site, really. I don't want it turning into a free-for-all image hosting service!

So, my guess is that I can check $HTTP_REFERRER in my PHP script that gets the images out of the database, to make sure it came from my site... But this won't work on all browsers, or through all proxies. Is there any other solution?

I've heard of something I can do to configure the apache server, but I'm running off a shared hosting system so I can't do this.

Any ideas? Or do I just have to go down the referrer route?

Simon

[deleted]

$HTTP_REFERER works on all modern browsers and proxies, so it's safe to use.

On a side note: forget about storing images in the database, it is pointless and only slows your application down.

Anon

Okay, I think I can put my images in a directory that is non-published, so there's no real reason for them to be in the database.

I suppose Re: the referer thing, I was thinking about anonymous browsers etc. (I have a friend who insists on using these things, wherever possible.)

I just had another idea, but I am not sure if this would work. It is potentially more secure, perhaps - I could copy the image file to a temporary file in a published folder, and delete it after the user has viewed it...

This could be a problem though, as my script will probably have terminated by the time I want to delete the file. Is this possible at all? It's interesting as a hypothetical even if I don't end up doing it.

Ideas?

[deleted]

"I suppose Re: the referer thing, I was thinking about anonymous browsers etc. (I have a friend who insists on using these things, wherever possible.) "

even anon browsers give a referer. They just fake the IP behind the request so you don't know who visited your site.

side note: poor people who use anonymizers. They really think they can browser anonymously. Don't they realize that by using the anonymizer they are sending all their www traffic through that company, so that company knows everything they do on the web??

Back On topic:

the 'temporary copy' of images is a common technique, but it gives a much higher load on the server. Not only to copy the image on pageview, but also to remove it after X minutes. Plus things like parsing the HTML code to change the image links to point to the temporary directory etc.

Anon

Yeah, I know. 🙂 But there's no talking to him! Didn't realise that it would send the referer too though. Cool.

'Delete the file after x minutes' can't be done here either, as I can't set up a cron job or anything like that, so once my script has terminated there's nothing I can do. Although the links would be no prob, as all my HTML is dynamically generated anyway.

Cheers for your help. Looks like it's definately got to be $HTTP_REFERER then.

Anon

vincent wrote:

$HTTP_REFERER works on all modern browsers and proxies, so it's safe to use.

On a side note: forget about storing images in the database, it is pointless and only slows your application down.

We sure seem to come down on the opposite side of things.

There is nothing wrong with putting your images in a database. I've been doing it for years, and if your system is configured correctly, reading the image from the database and delivering it to the user is just as fast from the database as from a static file on the disk.

One of my image gallery sites has over 10,000 images in a mySQL database and it handles over 1,000,000 image extracts each day without any problems at all. Performance is excellent as well.

Be smart, use the tools appropriately, and you can store practically anything you want in a modern database design.

-t