Question

I’m using crypt() which in the particular case uses an md5 hash with 12 character salt.

Here is an example of the string crypt() returns modified from php.net, crypt documentation.

$1$rasmusle$rISCgZzpwk3UhDidwX/in0

Here is the salt which also includes the encoding type.

$1$rasmusle$ 

Here it the encoding type. ( MD5 in this case )

$1$ 

and finally the hash value.

rISCgZzpwk3UhDidwX/in0

You can not have forward slashes in file names as this will be interpreted as a folder.

Should I simply remove all the forward slashes and are there other issue with the characters set that crypt() uses.

Answer 1

It looks like you want to prevent / allow access to the image for specific users. If that is the case I would do the following:

1. Store the images outside of the document root. This makes sure the images cannot simply be directly requested.
2. Store the images original name in the database and also store the sha1_file() hash in the same record. This adds the benefit if not having duplicate images on your server. Although images are small it prevents cluttering of the system.
3. When somebody requests a “private” image they will request it through a PHP file which will check whether the user has the privileges to access the file and if so serves the file (from the database).

With the above method you will have the most control over who can request the images and your users will thank you for that.

Note: that you cannot simply store all images in the same folder, because all filesystems have limits as to how many files can be stored in a single directory

A simple example of a PHP script that serves an image would look something like the following:

<?php

// always set the header and change it according to the type of the image
header("Content-type: image/jpeg");
echo file_get_contents('/path/to/the/image.jpg');