protecting images

bsj

I'm running into problems with people stealing the photographs off my site and using them in their own commercial projects. Is it possible to write a wrapper script which calls the images if my site requests the page, but not if any other site requests it?

i.e. <img src="wrapper.php?id=1000"> if called from my site will display the photo

but if someone links to it, it doesn't display it, or display a nice nasty gram.

I have all the code written to call up the image, that's not the problem - the problem lay with determining who called the wrapper php page - how does one do that?

Thanks!

Brian

LordShryku

Well, I'm sure there's a way to do the wrapper thing also. Here's some javascript for diabling right clicks. It will stop some people, but you still need to find another way as this isn't fool-proof.

<head>
<script language="javascript">
function protect(e) {
    alert("Sorry, you don't have permission to right-click.");
    return false;
}
function trap() {
    if(document.images)
        for(i=0;i<document.images.length;i++)
            document.images[i].onmousedown = protect;
}
</script>
</head>
<body onLoad="trap()">

examancer

you could use the $_SERVER['HTTP_REFERER'] variable to make sure the link came from your site, but this can also be circumvented:

from the PHP Manual info on 'HTTP_REFERER':
The address of the page (if any) which referred the user agent to the current page. This is set by the user agent. Not all user agents will set this, and some provide the ability to modify HTTP_REFERER as a feature. In short, it cannot really be trusted.

steve8557

It may be possible (I've not tried it yet) to protect your images if you recreate them using the gd lib. I've created simple images from scratch that simply do not exist outside the browser instance. Downloading and right clicking to save can't happen the image does not exist.

At the end of the day, there is no real way to stop people taking copies as there is always the screen shot route. :mad:

regards
Steve

drawmack

you could put the images into a database then write a php program that will retrieve the image but that doesn't solve anything cause the person can still save it from your site. Disabling right clicks (as above) is good but if the person turns off scripting they get around it.

The best method is to water mark the pictures with a visible water mark then you can sue people who steal them.

LordShryku

Yeah, and even with scripting on, there is screen shots or File->Save, which saves everything. Drawmack has a good idea there though. Mark yer logo on there, and they'll have to do a lil work if they wanna steal em....

bsj

Thanks for the suggestions. I am going to start watermarking everything now - I'm going to abandon attempts to block linking, I can't find a bullet-proof way to do it. But watermarking is pretty easy to do, that seems like the best route to take.

Brian

http://www.oneiromancer.org

drawmack

there are also watermark services where you can get a binary watermark that shows up on a print of the picture so you can prove that it's your picture. But for your problem a visible water mark is probably better.

It you're having a problem with people hotlinking your files you could always throw them into a database and use a php application to load them.

Then you can use the php script to do basic hotlink prevention and also to log information about the loaders so it someone spoofs past your protection you'll know that they are hotlinking this file and then you can change it's ID and update your programs to access the new one.

santak

to prevent hot linking, try using .htaccess files. I haven't used this one myself yet, but read about it in case I need it. Here is one source I found, but you can find many others in google:
http://www.hostingmanual.net/other/htfun.shtml

LordShryku

I thought of yet another way you could protect your images. You could convert them to Flash SWF files. That way, right clickingon them doesn't give them the option of saving...

laserlight

unfortunately it still is possible to save SWF files.

.htaccess is probably the best option, though it wont stop people from actually downloading and re-using your images.

at least your bandwidth wont be stolen.