html - Make src point to a php page -

html - Make <img> src point to a php page -

i have images saved in root directory normal user can't access. randomly generate filenames, don't want them know path or name of file. currently, have img element so:

<img src="get_image.php?id=1">

i have get_image.php page so:

<?php include_once 'includes/db_connect.php'; include_once 'includes/functions.php'; $uploaddir = '/root/......./uploads/'; //direct path root folder holding files $id = $_get['id']; if(!is_numeric($id)) { die("file id must numeric"); } // quick query on false user table $stmt = $mysqli->prepare("select `name`, `mime` `uploads` `filmid`=?"); $stmt->bind_param("i", $id); $stmt->execute(); $stmt->bind_result($name, $mime); // going through info while($stmt->fetch()) { header("content-type: " . $mime); readfile($uploaddir.$name); } ?>

if there someway can this? don't want phone call image file src straight so:

<img src="../../../uploads/file.jpg"> <!-- don't want -->

doing way give user (or attacker) hint of maintain uploaded files. these images user-uploaded, if attacker upload image malicious code (even though have lots of code checking , validating file), wouldn't know file saved.

also, i'm new web development , keeping secure. if have hints or pointer add together onto have create webpage more secure, please sense free. thanks!

i'm using this link create functionality secure.

solution:

instead of:

header("content-type: " . $mime); readfile($uploaddir.$name);

i set this:

header("content-type: " . $mime); $contents = file_get_contents($uploaddir . $name); echo $contents;

and works.

i have disagree current answers. if you're looking through database, such as:

<img src="/phpimages.php?id=23" alt="{alt}" />

phpimages.php take id 23 , output file. end users have no clue images coming from; come server. alternative allows bit more readable code, while still maintaining same security.

<img src="/phpimages.php?frontimage" alt="{alt}" />

now utilize described in link below allow key of first $_get association. or create id=frontimage , utilize $_get['id']

get first key in (possibly) associative array?

php html mysql image