PHP and Password Protected Directories

imnewtophp

I've set up a PHP and MySQL member section on my website, but want to display some images that only members can access. The script lets users onto a PHP page, which detects a cookie to see if they're logged in. If the page does not detect a cookie, the code stops and only the header of the page is shown. I need to display images that are for members only, but am concerned that people will just go to my images directory and find them on their own. I was wondering if PHP could log into a password protected directory which uses .htaccess.

Thanks for any input, or a new way around this problem. Script examples wold be appreciated since I'm an extreme beginner. 🙂

devinemke

you have a few choices:

store the files in a directory within the document root that is not world readable, or in a public directory where the individual files are not world readable. (use CHMOD on a UNIX server to change permissions)
store the files outside of the document root and use [man]header[/man] to serve them up only to users who logged in.

option #2 is more secure

imnewtophp

Can you specify exactly how to do this? I'm really just getting my feet wet with PHP.

Blulagoon

What operating system is your web server running under, and are you hosting the production system yourself or via a webhosting service ?

With IIS running under Windows the default setup is that files need to be placed under inetpub\wwwroot to be accessible to the web service. If you store your images as say C:\images and create <img src="C:\images\member_pic.jpg"> type tags in your html your images directory is not going to be available to the general public.

HTH - Blu

n.b. In above configuration this would also work:
<img src="C:\images<?php echo $row['filename']; ?>">
if you are grabbing filenames from the MySQL db

imnewtophp

I'm using Yahoo! Small Business Web Hosting to host my website, so I don't have actual administrative access to the server, just to upload files via FTP.

Blulagoon

Have a read, looks like this might do what you want.

http://corz.org/serv/tricks/htaccess.php

Blu