Security - uploading images

[kh100uk]

hi folks,

I've been reading a lot of the discussion going on in this site about security - it has been hugely helpful, so thank you!

I was particularly interested in the discussion at http://www.thescripts. com/forum/thread1954.html . I liked the idea of having uploaded images stored outside of the webroot and only displayed when pulled through by some php code. Has anyone done anything like this? If you could give me some pointers on how it would work I'd be very grateful. I've googled it and not found anything which has helped much.

Thanks very much

Karen

[ronverdonk]

Welcome to TSDN!

The forum discussion you mentioned in your post really addresses all the issues. Most important one is to have your upload program have write access to a folder outside the document root.

When you do not have that permission (and usually you don't on a shared host) you have to look for the use of htaccess or a login method to prevent outside users from accessing the folder.

Ronald :cool:

[kh100uk]

Hi,

Thanks for the rapid response!

The bit I wasn't getting was how you actually display an image via a php script if it is stored outside the webroot. Or, how you could use htaccess to allow a file to be viewed only when called from a particular script?

Thanks

karen