Newbie question on storing images

[Anon]

Hi there,

I am currently working on my first php project 🙂

I need to store images on the webserver, which works fine.

All the path and other information goes into a mySQL db... that works fine as well.

I retrieve the path from the db and echo an image tag in the user\\'s browser...

But how do I keep Users from directly accessing the images by simply typing in the path?

Curious and ignorant,

Toby

[Anon]

hi,
There are many functions in MySQL which send the data encrypted and data decrypt when receiving check MySQL documentation.

Good Luck
s.r.k.reddy.

[Anon]

I don\'t get it.
I am storing the files on the file system. What I would need, is a way of limiting access to the respective folder, so only my script can retrieve the image and display it in the browser.

Are you suggesting I encrypt the binary data for every image and then store it on the server?

If so, wouldn\'t that blow up filesize?

[jonno946]

You can store the images below the document root. You can then store the path (not the url) in MySQL, and call the images from that.

Jonathan

[[deleted]]

Just put the images in a directory somehwer outside the documentroot, and use PHP's passthru() function to read the file and pass it to the client.

BTW there is nothing stopping the clients from just putting the link to that script in their image tags and still get your images.
You could use the HTTP_REFERER to get a little more security, but that's spoofable/not a required feature of HTTP, so it's not reliable.

[Anon]

I'll have to checkout that function. Thx.

So if that script itself is protected (I have password protection based on sessions and user rights), I should be alright?

[[deleted]]

Yup, that should work.

[greg252]

what about just changing the permissions of the image folder to be read/write/execute by owner and deny read/write/execute by ALL and group?

[Anon]

That includes the browser requesting the file, doesn't it? If I use echo "<img..."
for showing the images...

[[deleted]]

Nope, the webserver runs the PHP scripts, so all file operations are done by the same user.

[Anon]

I am trying fpassthru

Thx for all your help. Gonna go register now 🙂

[Anon]

"But how do I keep Users from directly accessing the images by simply typing in the path?"

My guess is you are refering to the user typing the path directly into the browser to GET the variables. Why not tell the script to exit if any GET variables are detected? Of course, that would mean programming not using GET variables.

if ($_GET)
{
echo "ah-ha, gotcha";
exit;
}

pik kode....

[Anon]

Hi!

Why do you have to prevent the user from directly accessing the image file? They had already loaded and seen it in the browser when the page was rendered, so why bother?

The best strategy would be to store all images outside of the server path and make a special php script that will send the image header and the image data to the browser. This is what ad servers do:
<img src="myscript.php?id=101" width=100 height=100>

I hope this helps,
Stas