If you have a slideshow in flash that loads images directly from the server, all one needs is firebug to see exactly where those images are located.
What you can do is to make all of your image requests through a php script which controls access based on some critieria -- that criteria can be whatever you want but you are going to have to be more specific about what your demands are.
Example script:
<?php
// This script is a gatekeeper for images
// this should be the path to your images
// they should not be in your web root
// and this value should have a trailing slash
define('IMAGE_DIR', '/path/to/my/images/');
// === PUT YOUR GATE KEEPING CODE HERE ===
if (!isset($_GET['img'])) {
// alternatively, you could spit out a generic 'not found' image.
die('Image not specified');
}
// this makes sure that the requested filename ends in jpg, gif, png, or jpeg
if (!preg_match('/\.jpg|\.gif|\.png|\.jpeg$/i', $_GET['img'])) {
die('invalid image request');
}
// this one prevents anyone from trying to go "up a directory"
// it also means you can't have any image paths with two periods in a row
if (preg_match('/\.\./i', $_GET['img'])) {
die('you sneak. no looking outside the image dir');
}
// this one prevents anyone from using an absolute path
// only works on *nix
if (preg_match('/^\//', $_GET['img'])) {
die('you bastard. how dare you use an absolute path');
}
$complete_path = IMAGE_DIR . $_GET['img'];
// make sure it exists
if (!file_exists($complete_path)) {
die('image does not exist');
}
// you should probably sniff out what kind of image it is and send a header first
header('Content-Length: ' . filesize($complete_path));
readfile($complete_path);
?>
The point of this script is that you could check anything you want. You could check $_SERVER['HTTP_REFERER] but this is reported by the client so you are still vulnerable to cheats, but the cheaters would have to figure out what you are checking.
You could set a value in $_SESSION on a previous page and then make sure that session var still exists in this script before coughing up the image -- that would require them to visit at least one other page.
You could require a login.
You could do pretty much anything you want in PHP. You just need to be more clear about what it is you want.
