images on file system -> control access

[tobias]

Hi there,

I have images stored on the web server in the filesystem, which I need to retrieve and display in the browser.

The problem is that they should only be accessible through my script, which in turn is protected by a login/password system - and not by typing in the url in the browser.

Vincent suggested I use fopen. But I can\'t get it to work.

I tried this:

$filename= \"images/admin/1/3.jpg\";
$fp = fopen($filename,\"rb\");
$contents = fread ($fp,filesize($filename));
echo $contents;

Which works fine on my local machine, but doesn\'t on the webserver.

Anyway I am not sure if the direction I am heading is even right.

Any ideas as to how this can be solved? Someone must have done it before 🙂

As you can see I don\'t know a whole lot about php (or webservers for that matter)... just getting started.

Toby

[mistcat]

if you wanted to get really in depth with this, you might try storing the images in a database and retrieve them as needed, thus preventing them from being browsable.

There is a brief example here on phpbuilder:

http://www.phpbuilder.com/columns/william19990908.php3

one other method you might try is having the images outside the webpath and then copying them into the path with php as needed.

Note both of these are sort of performance hits in order to impliment, but if you have a low intensity website they could work. =)

• nate

[tobias]

I have heard so many people voting against storing them in the database...

I am only storing the path in the database as it is supposed to become rather large...

[rrijnders]

Hey Toby,

The directon you are going is fine for what you want to do.

1) Store the images in a directory that is out of the web server's document tree.

2) Have your secured script write out an image tag to the web page in which you want the image to be displayed that looks something like:
<b><IMG SRC="showpic.php?id=9999"></b>

3) "showpic.php" should also be in the secured directory. Heve it send the headers for the image type, then use fopen() and fpassthru() to send the image to the browser. Just remember that the path to the image in fopen() must be the absolute path on the server, not a path relative to the document root.

HTH
-- Rich

[mistcat]

Richard's solution is excellent, much better than my idea.

• nate

[Anon]

Thanks, guys. I have tried Richard\'s solution and it seems to work flawlessly...

🙂

Toby