Home/ Questions/Q 3987964
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-20T06:11:46+00:00

Is it necessary to abandon an uploaded image’s extension when saving it above document

  • 0

Is it necessary to abandon an uploaded image’s extension when saving it above document root? I’m thinking of calling the image through img.php?i=thisImage.png, where inside the name of the image is run through mb_split('.',$_GET['i']) and the latter is used as inside header('Content-Type: image/$img[1]'). As my personal opinion, it doesn’t seem to matter either way, be it img.php?i=thisImage.png or img.php?i=thisImage, but I’m always about tightening security.

Also, what are some of the best methods, aside from a PHP proxy with Content-Type: Content-Length: and serving the images from above document root? I’ve heard mixed opinions about copying the image from source through IM, but as I’ve said they’re mixed opinions.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I know of no problems with leaving the file-name alone, if the file is saved outside the web-accessible area and pushed to the client through a script.

    The method I use (in KFM, and in my CMS), is to use mod_rewrite to redirect calls to a script which will retrieve the file for you.

    For instance, if you have the URL /f/file.jpg, but the file is actually located at ../files/file.jpg, then you use mod_rewrite to “catch” the request and redirect it to a script. For instance:

    RewriteRule ^f/(.*)$ /get-file.php?filename=$1 [L]

    then write get-file.php, using something like readfile() to pass the file through

    • 0