Forum Moderators: coopster
First, create a new file called showpic.php and put this code in it:<?php
header("Content-type: text/html");
header("Expires: Mon, 26 Jul 2007 05:00:00 GMT");
header("Cache-Control: no-store, no-cache,
must-revalidate");
header("Cache-Control: post-check=0, pre-check=0",
false);
header("Pragma: no-cache");
$pic = strip_tags( $_GET['pic'] );
if (! $pic ) {
die("No picture specified.");
}
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
"http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<title><?php echo($pic);?></title>
<meta
http-equiv="Content-Type"
content="text/html; charset=iso-8859-1"
>
</head>
<body>
<p>
<img src="/<?php echo($pic);?>" alt="Image">
</p>
<p>
Image from
<a href="http://www.yourwebsite.com/">
your web site</a>.
</p>
</body>
</html>Needless to say, you should change the HTML to match your own web site.
OK, so I can tell where to put my domain in there, but I have tried to find out where -if anywhere- I am to insert the NAME of the file I will be referencing:
mypic.gif
after some explanations, the site says this:
So far, this is just a simple script. Go to www.yoursite.com/showpic.php?pic=mypic.gif and it will output a simple page showing myname.gif and a credit.
the above explanation shows 2 files:
mypic.gif
myname.gif
is this a mistake?
Basically, I have a file named mypic.gif and I want the above script to work for that file, but right now all I can do is get it to pull up a page that says:
No Picture specified
there is some other stuff that I have to do with an htaccess file, but I want to make sure this works first and I am a clueless moran.
apparently I cannot even cut and paste code.
It is accessing the $_GET super global array, which stores information from the querystring:
showpic.php?pic=mypic.gif
It's a typo with the 2 different names. As long as you have an image called mypic.gif in the same directory as the showpic.php file, this should work.
Beware, this script isn't very secure. If you want to stop people from being able to use this to exploit your site you should validate the $_GET['pic'] variable and make sure it doesn't contain something like:
showpic.php?pic=http://www.evildomain.com/stealyourcookies.php
You can change this code:
$pic = strip_tags( $_GET['pic'] );
if (! $pic ) {
die("No picture specified.");
}
to this:
$pic = $_GET['pic'];
if (! $pic ) {
die("No picture specified.");
}
if (!preg_match('/^([\w]+\.)+(jpe?g?¦gif¦png¦bmp)$/', $pic))
{
die('Only images from this directory are allowed');
}
That should prevent anyone from being able to put dodgy stuff in the query string, but will allow you to only use images from the same directory the php page is in. If you need to access other directories you can always prepend the path afterwards:
$imageDir = 'my/image/dir/';
$pic = $imageDir . $pic;
