Question

I need a php file with the ability to download multiple images per se from a folder on my server, with an unique ID per image.

e.g.

I have an image on my server: /home/example/public_html/multipleimage/2.png

And I want to download that image through the unique php file: http://example.com/file.php

I would type the following url: http://example.com/file.php?id=2
And the browser would have to return the image.

But… how should be the php file?
Can it be done without going through a database?

Thanks.

Answer 1

<?php
header("Content-Type: image/png");
readfile(
    sprintf(
        '/home/example/public_html/multipleimage/%d.png', 
        $_GET['id']
    )
);

See the following entries in the PHP Manual:

• header – Send a raw HTTP header
• readfile – Reads a file and writes it to the output buffer.
• sprintf – Returns a string produced according to the formatting string format.
• $_GET – associative array of variables passed to the current script via the URL parameters

Note that I am using sprintf with %d, so it will silently convert any non-numeric id value to 0, so a malicious input like ../../etc/passwd will try to read 0.png. If you want to use anything else but numbers, you need to sanitize the input to prevent directory traversal attacks and null byte poisoning (before PHP 5.3.4):

• filter_input – Gets a specific external variable by name and optionally filters it