Code-Bin #64 - PHP Image Script

PHP Image Script
Posted by: Stephen | November 22, 2007 @ 2:11pm

PHP Code

<?php
$file = urldecode($_GET['I']); // Filename
$folder = "/htdocs/images/"; // Folder containing files - can be absolute or relative to current directory

if (!preg_match('/$', $folder)) {$folder = $folder . "/";} // Adds trailing slash to $folder

// The line below essentially makes it impossible for script to roam outside of $folder or its subfolders
$the_path = preg_replace('@\.@', '', $file, (preg_match_all("/\./", $file, $matches) - 1)); // Strips all periods except the one for the extension
$filename = "{$folder}{$the_path}";

while (strrpos($filename, '//')) // Gets rid of these: //
{$filename = preg_replace('@//@', '/', $filename);}

$path_parts = pathinfo($filename);
$ext = $path_parts['extension'];

// Only the following types of files will be displayed with this script
$mime['jpg']  = "image/jpeg";
$mime['jpeg'] = "image/jpeg";
$mime['gif']  = "image/gif";
$mime['png']  = "image/png";

if (!file_exists($filename)) {die("File doesn't exist.");}
if (!array_key_exists($ext, $mime)) 
{echo "This type of file is not allowed to be displayed.";}
else {header("Content-type: " . $mime[$path_parts[extension]]);
header('Content-length: ' . filesize($filename));
readfile($filename);
}
?>

Syntax Highlighting

[Open in new window]

Author Comments

This is about the simplest and secure image script. While I give no warranties or guarantees about this script's usefulness, it essentially makes it impossible for anyone to get outside of your specified folder and roam around your site.

This script will allow you to show images, but only explicitly specified extensions can be viewed.

Why is this script better than most others?
This script limits viewing images to certain types.
You show images in any subfolder under $folder.
Users can not access any folder up from $folder.
Nice error messages.

Rating

4.48 / 8
498 Votes