Uploading/Displaying Images, Which Way Is Better?

[RedChair]

I am creating a site that will allow people to add images for businesses in my community. I am stuck on which way is better to safely upload and display the images.

Either I can have the images uploaded to the server and have the file name stored in the database so when people view the image properties, the path is as such: www.example.com/images/file.jpg

The other way of course is to have the image saved and the path will be something like www.example.com/viewimage.php?id=123

What I would like to know is which way is better? I want to be able to resize the images but more importantly I want to make sure that the images are actually images and not a file that just has the .jpg extension. Is there anyway to check that?

Thanks for your help.

[edited by: eelixduppy at 7:24 pm (utc) on July 10, 2007]
[edit reason] switched to example.com [/edit]

[mattclayb]

personally I would upload the image to a file on the server, and call the image through a dynamic link.

I would use something like phpThumb to do the resizing of the image. Just Google 'phpthumb' and you should find the script.

In terms of checking to see if the file is a genuine jpg image, you could use getimagesize() to find the width and height of the image, and if it has no width or height delete it (as in that case it wouldn't be an image).

It would be something like this -

$imagePath = "path_to_uploaded_image.jpg";
$imageSize = getimagesize("$imagePath");

if($image[0] <= 0 ¦¦ $image[1] <= 0){
$fh = fopen($imagePath, 'w') or die("can't open file");
fclose($fh);
unlink($imagePath);
echo "Invalid image file, please try again";
}

[RedChair]

That worked great, thanks a lot!

[ergophobe]

I will just add that I noticed a site slowing down a *lot* after making a number of changes. I did some profiling and found out that the main drag was getImageSize() running on several images on a page.

So, as mattclayb suggests, do all checks on upload.

[distorto]

I found this article helpful on the subject.
[net-security.org...]