Image Viewer

vcore

I am try to view an image viewer for a site. Basically a users will click a thumbnail pictured then I want a picture to open in a new page in my imagerviewer.php. This is going to be very basic and will rely on this code:

<?php

$file = $HTTP_GET_VARS['file'];
$item = $HTTP_GET_VARS['item'];

?>

<?php echo "<img src='./$item/$file'>"; ?>

Its very basic- I make a new url with the appropriate folder (in the file var) and the image number in the item var. My concern is the security. What kind of limitations can I put on the input so no one is playing with my server? I only need image files opened up and only images within a certain area. Is there a way to place limitations on the variables?

I am very new to php, so I appreciate the help...

Weedpacket

Certainly you can place limitations on the variables. You can't stop the user sending you anything they feel like, but you can certainly check them when you receive them, and only allow through the ones that are valid.

If there are only limited number of possible values for $item, you can make an array of them and check that the supplied $_GET['item'] is in the array:

$allowed_items = array('this', 'that', 'yonder', 'other');
if(!in_array($item, $allowed_items))
{
// the $item is invalid. Handle this according to whatever policy you have: E.g. set $item to something valid and harmless
}

Similar for $file.

If a field is supposed to be numeric and in a certain range, use [man]is_numeric[/man] and the comparison operators to check.

Later on, the fixed array could be replaced by something that examines (I presume) the filesystem to see what possible values for $item and $file there are, and then checks what the user sends against that.

vcore

OK great, I get it : )

In my case there is set array but rather a number of files where the items can be pulled from and then the file name (like image_001.jpg)

Is there a way I can only have image file viewed?

How about limit the images viewed to be within a certain directory?

Weedpacket

That's what I referred to in my last paragraph. You can have a look at the [man]filesystem[/man] section for functions that read directories for lists of files.