We help IT Professionals succeed at work.

We've partnered with Certified Experts, Carl Webster and Richard Faulkner, to bring you two Citrix podcasts. Learn about 2020 trends and get answers to your biggest Citrix questions!Listen Now


Streaming mpeg files via PHP (files outside of www or public_html folder)

rooseveltrp asked
Medium Priority
Last Modified: 2012-06-27
Hello there,
I am trying to built a pretty powerful cms but really stuck in this small part and can't figure out how to do this. I have some .mpg clips stored under /home/myusername/clips/. So you will see the folder clips is not under the www or public_html folder.

At the moment I am just testing if I can play the media files outside of the www folder and here's what my quick PHP file looks like.


<object id=\"MediaPlayer\" width=320 height=286 classid=\"CLSID:22D6f312-B0F6-11D0-94AB-0080C74C7E95\" standby=\"Loading Windows Media Player components...\" type=\"application/x-oleobject\" codebase=\"http://activex.microsoft.com/activex/controls/mplayer/en/nsmp2inf.cab#Version=6,4,7,1112\">

<param name=\"filename\" value=\"/home/myname/clips/test.mpg\">
<param name=\"Showcontrols\" value=\"True\">
<param name=\"autoStart\" value=\"True\">

<embed type=\"application/x-mplayer2\" src=\"http://media.pmcmovies.com/SixtiesLove.wmv\" name=\"MediaPlayer\" width=320 height=240></embed>



You will see the filename parameter has the full path to the file... for some reason it isn't working. I am sure there is a way to play this file, and will really appreciate if someone could help me out here :).
Watch Question

All you've done there is output a bunch of HTML; it's no different than if you'd written that code statically (i.e. not using PHP at all).  When the web browser receives this, all it sees is a <param name="filename" value="/home/myname/clips/test.mpg" /> tag and it's no more able to retrieve the file than it was before.

I'm sure you envisioned originally that since PHP can access files outside the www or public_html directories, it ought to be able to serve up the file.  That's true; it sure can (with some restrictions), but it has to serve the VIDEO file, not necessarily the HTML file.

As a quick-and-dirty way to do it, create a script in www called, say, movie.php that works like this:

<?php readfile('/home/myname/clips/' . $_GET['filename']); ?>

This tiny bit of code just goes to whatever filename is in the 'filename' URL arguemtn and dumps the whole thing to the browser.

Then, your HTML will contain <param name="filename" value="/movie.php?filename=test.mpg" />

A couple things to note:
1.  If PHP Safe Mode is on, then the script will not be able to access any files anywhere on the filesystem that are owned by anybody other than the owner of the script.  So, if bjones owns the script, then it can only open other files bjones opens.

Usually PHP scripts execute as 'nobody', so if the 'nobody' user doesn't have access to the file then it's off-limits no matter what.  That's just logical.

2.  Make darn sure you're validating that the "filename" passed in is really a valid path to a movie.  The way I've written it, that script will gleefully spit out any public file on your server, making your system pretty darn exposed to hackers.  I imagine you'd want to avoid that, eh?


Hi VoteyDisciple,
Thanks for the attempt and I understood your concept completely. But still the file fails to load... may be something in the server is restricting it.

Here is what my PHP file looks like (named it player.php):


$path = "/home/name/clips/";

switch ($_GET['id'])
      case 1:
            $filename = "test.mpg";
            $filename =  "BLANK";

$filelocation = $path.$filename;

if (file_exists($filelocation))
      echo "Invalid Media File!";


and here's my HTML file which actually plays the media:

<object id="MediaPlayer" width=320 height=286 classid="CLSID:22D6f312-B0F6-11D0-94AB-0080C74C7E95" standby="Loading Windows Media Player components..." type="application/x-oleobject" codebase="http://activex.microsoft.com/activex/controls/mplayer/en/nsmp2inf.cab#Version=6,4,7,1112">

<param name="filename" value="player.php?id=1">
<param name="Showcontrols" value="True">
<param name="autoStart" value="True">

<embed type="application/x-mplayer2" src="http://media.pmcmovies.com/SixtiesLove.wmv" name="MediaPlayer" width=320 height=240></embed>

When I load the HTML file in the web browser it keeps loading something but doesn't display the clip. To test I visited by the PHP file like this http://myurl.com/player.php?id=1 and it automatically launched Windows Media Player but kept loading something but not the clip.

In addition I've checked my php.ini file and safe_mode is turned OFF.
It would probably be good to throw out a correct Content-Type header:
header('Content-Type: video/mpeg');

(or whatever the correct content-type for your file would be)

I doubt that's really the problem though.

I might suggest two things to get a better sense of this:
1.  Try downloading the file to your hard drive where you can look at it raw (in hexl-mode in emacs or at least in Notepad or something) to see if theres' junk at the beginning of the file that's screwing it up -- extra whitespace or something -- or if it's really just a whole bunch of binary data that you can only assume are the proper contents of the file.

2.  It'd probably be useful to use a really small MPEG file for this if you've got one.  (-:

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.