photo gallery question

hi every body
I need help please

i have designed an image gallery of about 20 pictures and they are
shown in thumb nail views and for viewing the largeer version of the
images i have added a radio button and a push button, so that the user
choose the picture using the radio button and click on the push button
to open the larger version picture in another window, but my problem
is that i know how to pass the selection to the second page but the
problem is how to pass the selected picture not selected value.

the first html page code is:

<form method="POST" action="gallery.php">
<input type="radio" value="V1" name="nature">
<p><input type="radio" value="V1" name="nature"></p>
<p><input type="radio" value="V1" name="nature">
</form>


the gallery.php code is:

<?php
$image = $_POST['nature'];
echo "$image"
?>


my problem is that this way gives me the name of the radio button i
select not the image so how i can make the image get shown not the
radio button name (not V1)


Thanks in advance for your help

shror

re: photo gallery question

On Sun, 25 Feb 2007 21:10:57 +0100, shror <shahirwm@gmail.comwrote:
I can see two methods to help you out in this case:

1) Alter your form: change the radio button names into the text "picture"
and change the value of each radio button into the name of the actual
picture, like so:
<form method="post" action="gallery.php">
<p><input type="radio" value="nature.jpg" name="picture"></p>
<p><input type="radio" value="sun.jpg" name="picture"></p>
<p><input type="radio" value="snow.jpg" name="picture"></p>
<p><input type="submit" value="Show me" name="btnOK"></p>
</form>

That way, your gallery.php can read $_POST['picture'] and it'll give you
"nature.jpg"
"sun.jpg"
"snow.jpg"
which you then can show using fopen() for instance.

This method however has a drawback: it'll show any file whose name is
presented go the gallery.php, meaning that any person with ill intent
could make it load any file at all. Thus there's a second method:

2) Alter your form and the gallery.php to use indexed picture numbers
instead of picture names, like so:
<form method="post" action="gallery.php">
<p><input type="radio" value="1" name="picture"></p>
<p><input type="radio" value="2" name="picture"></p>
<p><input type="radio" value="3" name="picture"></p>
<p><input type="submit" value="Show me" name="btnOK"></p>
</form>

That way, your gallery.php can read $_POST['picture'] and it'll give you
1, 2, or 3 respectively, which you can use in a routine as follows:

$arrPictures = array();
$arrPictures[1] = "nature.jpg";
$arrPictures[2] = "sun.jpg";
$arrPictures[3] = "snow.jpg";

$imageIndex = $_POST['picture'];
if (isset($arrPictures[$imageIndex])) {
if (file_exists($arrPictures[$imageIndex])) {
$imageFile = fopen($arrPictures[$imageIndex]);
echo $imageFile;
@fclose($imageFile);
}
}

Don't forget to set a mime-type header!

Hope this helps!

--
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/

re: photo gallery question

On 25 Feb, 20:10, "shror" <shahi...@gmail.comwrote:You need to use different values but the same name. But really, you've
made interaction with the site a lot more complex than it needs to be
- why not just link directly to the larger version of the image - one
click instead of click, scroll, click. Even if you want to do this
with a POST (from the code you've published it should be a GET) it's
just a matter of assigning a value to a hidden field and submitting
the form using javascript.

C.

re: photo gallery question

On Feb 25, 10:44 pm, OmegaJunior <omegajun...@spamremove.home.nl>
wrote:thanks for your answer OmegaJunior,

i have tried the first method and i made a little bit small change and
it worked but i want to know about it and the draw back,

what i did is:
<input type="radio" value="<img src="www.mydomain.com/directory/
image.gif">" name="nature">

and i call it in the second page gallery.php in this way:
<?php
$picture = $_POST['nature'];
echo "$picture";
?>

what do you think about this is it the same having the same drawback
or its different, am sorry if my question means nothing but am still
beginner in php, so i dont know how any person with ill intent
could make it load any file at all.

-------------------------------------------------------------------
about the second way,

i dont know about mime-type header!

what is it and its use and how to set it.


am really so sorry for my silly dumb questions
and really very Thanksful and apreciate your help

shror

re: photo gallery question

On Feb 25, 11:59 pm, "C." <colin.mckin...@gmail.comwrote:Thanks also for your answer Colin,
The problem is that i will be using the picture that will be chose
from the thumbnails as a larger version in the gallery.php page and
will then add some information about the picture in this second page.

so i need to get the information according to the picture choice.

Thanks so much for any help

shror
www.s7els7.com
www.beachtoursegypt.com
www.mobidp.com

re: photo gallery question

On Mon, 26 Feb 2007 13:29:36 +0100, shror <shahirwm@gmail.comwrote:Adding the entire <imgelement into the radiobutton value is a creative
idea, but unfortunately you'll get into trouble with the quotes and the
html validity. Instead, you may want to try something like this in your
form:
<input type="radio" value="sun" name="image">

and this in your form handler:
<?php
$picture = $_POST['image']; //will now contain 'sun'
echo '<img src="http://www.yourdomain.com/nature/'.$picture.'.jpg">';
?>

The security problem comes in when someone creates a form on their own
server like so:

<form action="http://www.yourdomain.com/gallery.php" method="post">
<input type="radio" value="../veryhidden.txt" name="nature">
<input type="submit" value="OK">
</form>

That way they can have your gallery.php show the file 'veryhidden.txt' in
the root directory of your site, unless you specifically test for the
validity of the information passed to your gallery.php. Doesn't hurt if
you don't have a 'veryhidden.txt' file, but you get the idea. Hackers will
just guess some very common file names.

It's just about being nice to the browser. Check out the 'header()'
function on www.php.net. One of the ways to use it is like this:
header('content-type: image/jpg');

If used, it should be the first thing after <?php, and <?php should be the
first thing in your php file.

By supplying this, you can tell the browser what kind of file to expect.
Thus if you hand the browser an image you'd tell it to expect a mime-type
of 'image/jpg', 'image/png', 'image/gif' or whatever image you're
supplying. And if you hand the browser a web page you'd tell it to expect
a mime-type of 'text/html'.

In your case, because you're going to be printing html containing an img
element to the browser, you'd either supply a header like 'content-type:
text/html', or none at all, because for php files the default content-type
usually already is set to text/html.


--
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/

re: photo gallery question

On Feb 27, 1:28 am, OmegaJunior <omegajun...@spamremove.home.nl>
wrote:I want to tell you OmegaJunior that am working on your answer and am
trying to get some results.


first thing
I have tested the radio button when i added the entire <imgtag in
its value part and gave me errors because of the quotes like you said.
but then i was trying and i removed the quotes and its working great
without any problem, its looking like this,

<input type="radio" value="<img src=/images/button1.png>"
name="nature">

its really working fine


second thing
about securing the form i have tested the file named 'veryhidden.txt'
and its not found, but i was wondering about what is this file and
what is the use of it how its useful for hacker.


third
am working on finding a security way for the forms and will sure get
your openion if you dont mind.


fouth and finally for now is
to Thanks you for your detailed answers and your help for now and
later :D


shror
www.s7els7.com
www.beachtoursegypt.com
www.mobidp.com

re: photo gallery question

On Tue, 27 Feb 2007 01:04:42 +0100, shror <shahirwm@gmail.comwrote:
Excellent! What happens when your image name contains a space? Like
'/images/the first button.png'?
As I said, you may not have a veryhidden.txt (especially since I made up
the file name), but you will have a lot of other files, that may contain
passwords or other sensitive info, or may show pictures you'd rather only
show to people you select. Point is, that a hacker will take a look at
your form, then at the gallery.php, and then will come up with a fairly
simple way of getting it to show any file on your system.

They'd have to guess the file names, so let's guess... I expect your site
to have an 'index.php', maybe an 'index.html', possibly a 'default.htm'
and a 'default.asp' depending on the web server, probably a '.htaccess',
and perhaps a '.htpwd' or '.htpassword' in case you've chosen to secure
some of your directories. In case you're using a unix or linux server it's
possible that your mail is in your directories as well.

Imagine what would happen if you'd be running a database system that
requires you to log in with a user name and password. Some systems I know
use a file named 'config.ini' or 'config.php' for storing such
configurations. Imagine a hacker who happens to know or guess the system
you use, and then requests your gallery.php to show the contents of that
configuration file? They'd get immediate access to your password, user
name, and path to the database.
I don't mind at all.

Some things you can do:
1) Use an indexed file system, where you number your images, and you only
pass the image numbers through your form. The gallery.php will then pick
up the selected number and use it to fetch the accompanying picture. If
you add a check to see whether the received number actually is a number
and not just some text some hacker threw together, you'd be fairly safe.

2) If you insist on passing the actual directory and file names, you may
want to apply an encoding (base-64 for instance, see the b64_encode()
function) to obfuscate the names in the form. Then decode the names in the
form handler (using b64_decode() for instance) AND check to see whether
the wanted file exists in a directory of your liking (see the real_name()
and basedir() functions), AND check to see whether it's an image file and
not something else.
Much obliged! I hope it helps!



--
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/

re: photo gallery question

Message-ID: <op.toecyxs170mclq@cp139795-a.landg1.lb.home.nlfrom
OmegaJunior contained the following:

How would a gallery script show the contents of a .php file?
--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

re: photo gallery question

On Feb 27, 10:56 am, Geoff Berrow <blthe...@ckdog.co.ukwrote:The idea here is not to see the contents or the code of the
gallery.php but to get the code of the form and understand what it
pass to the gallery.php script which will be in this case the value of
the radio button.

second i'd like to tell you Thanks you OmegaJunior and sure you help
me and am working on what you told me and when i passed an image
containing in its name spaces i just replaced the space with %20 and
its working in the gallery.php
but if i added the image name with a space in the value of the radio
button its not read correctly in the gallery.php file so we have to
deal in the spaces with%20

shror


shror

re: photo gallery question

On Tue, 27 Feb 2007 09:56:29 +0100, Geoff Berrow <blthecat@ckdog.co.uk>
wrote:
That highly depends on the gallery script, doesn't it? If the script would
perform an fopen() or file() on any file name it receives, and then echoes
the result to the browser, you bet the contents of a .php will be shown.

If the gallery script merely enters the received file name into the src
attribute of an img element, there's little to fear. But if we'd enter it
into the data attribute of an object element or the href attribute of an
iframe element, there's a lot to fear.

--
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/

re: photo gallery question

Message-ID: <op.tofh7y0270mclq@cp139795-a.landg1.lb.home.nlfrom
OmegaJunior contained the following:
Thanks, I just thought it was worth pointing that out to the OP to
prevent needless paranoia.

--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/