Image Display from non web root folder

For testing whether they are images, you can:

1. check and/or correct their extension
    
2. try loading them with a graphics library like libgd -- if it succeeds, it's an image and you don't have to fear it 

OK - let me check out just what libgd is - not heard of that and I'll get back to it. Many Thanks. I'm just trying to ensure that no-one injects php/other executables into my files and if they did then they couldn't use it.

If that makes sense... Probably could have written that better!

Cheers. Laters

When you say "try loading then with  <snip> libgd" - how would you actually do that?

Hello highlawn, I agree with spule, about the suggestion to first place uploaded files in a non-web accessible folder , ONLY for testing, and or manipulation  (thumbnails, watermarks), and then place the checked files, and or thumbs, in a web accessible folder. BUT you may have other concernes for having non accessible image flies. here is some code I have used to get images in non accessible folders to a web page -
first is the code for the imggif.php

<?php
$fname = (empty($_GET['ifn'])) ? 'hili' : $_GET['ifn'];
//the file path below can be any that the PHP can access
if (!file_exists('home/images3/'.$fname.'.gif')) $fname = 'hili';
//be sure to have an error image
header('Content-Type: image/gif'); 
// warning, you MUST have the right header type, this is ONLY for GIF
//images, but you can code it so it changes the header type
readfile('home/images3/'.$fname.'.gif');
?>
 
- - - - - -  
-below code to get an Image in html
<img src="imggif.php?ifn=fluer2">

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:

OK, many thanks I will give this a go. So, effectively, what we are saying is that the libgd "test" will prove conclusively that the image is a bona fide image with no injected code whereas the construct

list($width, $height, $type, $attr) = getimagesize($_FILES['imgfile']['tmp_name']);

would return good even if code were in it?

As a consequence if we get the libgd seal of approval from any of the following (depending on image type)

$imgjpg = @imagecreatefromjpeg("filename.jpg");
$imggif = @imagecreatefromgif("filename.gif");
$imgpngg = @imagecreatefrompng("filename.png");

then we have no worries and it can be loaded into our web directory safely - thus obviating the need for any permanent off web storage?

Let's just hope my php has libgd compliled!

Ultimate guarantee would be cool - but I'm realistic enough to understand that there is no such thing. I'm pretty new at this game so I just wanted to check I'd interpreted what you two had said.

I do take your point regarding numpty users uploading huge images though :(

I think also that changing the file name is a good idea as I'm loading user images against profiles and just to keep track ot the images, I call the file profile_id."-".image_number.".".xyz so things end up like 2187-17.xyz
so are pretty unguessable.

Thanks for assistance. I'll split the points.