calling variables from a URL

sssphp

I need to call a variable from a URL link into a simple image display script. I've been told two ways of doing this, and I want to know which is preferred:

Method 1:

Example link to: /picviewer.php?/images/pic1.jpg

picviewer.php code -

<?php
if (isset($SERVER['QUERY_STRING']) && $SERVER['QUERY_STRING']) {

$image = $_SERVER['QUERY_STRING'];
}
print("<img src=\"$image\">");
?>

Method 2:

Example link to: /picviewer.php?image=/images/pic1.jpg

picviewer.php code -

<?php
print("<img src=\"$image\">");
?>

Method 2 seems simpler, but am I missing something (e.g. security issues)?

crazychris

well... apart from the HUGE security risk, both are fine, with the 1st one being less secure, but both are really bad anyhow...

sssphp

Thanks - what's a better way to do it, or what security code should I add, or where can I find some info?

crazychris

You would want a pre-defined list of images they can select from, each with an id, and if they didn't pass an id you have, then don;t display it.
Trouble comes when they edit the url to display things like config.php or connect.php or password file and so on.

sssphp

The only lines calling the URL variable are:

print("<img src=\"http://mysite.com/$image\">");

$size = getimagesize('http://mysite.com/'.$image);

Since both $image files must originate from my site, what is the security risk?

crazychris

becuase I can edit the URL directly in my browser to be
http://mysite.com/password.txt
and you have no control over that.

sssphp

I don't follow you. I have no file named /password.txt on my site, so an error message would display.

Even if they do find some file on my site to enter in the URL, it would still come up with an error message unless it's an image file, in which case, I don't care if they want to view some image.

Am I missing something?

crazychris

password.txt was an exapmple. It chould be any filename. If you blindly dump it's source to the browser, it'll cause mayhem!

If you validate it using
$size = getimagesize('http://mysite.com/'.$image);
then it should be ok, as getimagesize will error if a non-image is passed. So long as you refuse to display on error, should be fine. Using the url is more intensive for your script (and adds lines to your log) but ensures it's on your site.

frost110

As long as you do the proper checks, IE extension is .jpg etc. You should be fine. Just be wary that anyone could potentially pass in /includes/config.php and the script would retrieve that configuration file which could have all your passwords in it.

The bottom line is do checks before you execute the code. Meaning make sure the extension is correct. Better yet if you store the images via a database and reference them by ID or Name that would be ideal because then you are not giving them access to your file system.

--FrosT

sssphp

I've typed in several non-image filenames from my site, and each one simply displays an empty image box with the little 'x' in it. When I enter any fictitious filename, or any off-site URL, I get an error message.

I never print or read the variable string directly, only in the context of http://mysite.com/$image, and even then, I only print as an <img src>.

I'll add something to check the file extension, and also a die command on error. That should do it, right?