On 10 Mar 2004 19:43:54 -0800,
ieig-hp0b@spamex.com (ywg) wrote:
[color=blue]
>I'm generating an image using several PHP image routines:
>imagecreatefromjpeg, imagejpeg, etc. The PHP file containing these
>routines is meant to be included on web pages just like regular
>images, such as: <img src="image.php">. So far, all this works
>beautifully.
>
>Where I'm stuck is that I'd like to keep other web sites from
>including my image on remote web pages. I want the image to only
>display when rendered on pages from my web server. I would like to
>detect for any "remote" condition and then serve up an alternate
>image. I have the code for this part, too, but I don't know what
>condition to watch for.
>
>I'm thinking something along the lines of using $HTTP_REFERER or
>$SERVER_NAME, but can't seem to figure out how to make it work. The
>image.php file will always detect that it's being run from my server.
>It's the context that I would like to detect.
>
>Thanks for any tips!![/color]
The easy answer is you can't do this reliably...
Some browsers won't have the $HTTP_REFERER set due to
firewall/antivirus software. You'll need to allow these browsers to
display the proper image as they may be legitimate visitors. Where
the referrer is set, you can check that it is as you would expect for
the page and if not then serve up the alternative image.
It won't be 100% but it will be better than nothing.
Would this work?
Use sessions to hold an 'unlock' key for the image which is only only
available for that session - assuming your image is contained in a php
page:
1) Set a session variable to a random value.
2) Write this value into the tag:
<img src="image.php?key=<?php echo $_SESSION['key']">
3) in image.php, check that the value for $_GET['key'] is the same as
the one in the session and if it isn't then it's being leeched.
