Passing Variables/Security Issues

[xoot]

Hi

I am new to this web site and fairly new to PHP so I apologise if my description of the problem I have is not that clear.

I am basically trying to set up a third party PHP script that uses a variable to display an image. The thing is my site was set up with a mixture .shtml and .cgi and I don't know how to include the PHP script in them.

The solution I have come up with is to have the PHP script included as an iframe and the variable passed in the url:

www.mydomain.com/script.php?image=imagename.gif

This works perfectly but since I pay for each image display it is open to abuse as anyone could link to the script and use my account to display these images on their site. It is unlikely but you can't discount these things happening.

So my questions are:

1. Is there a script or way to make it so these images can only be used on my domain? If this is possible it needs to be so the parent frame is on the same domain too.

2. Is there a way to hide the url or encode it so that my site knows whats going on but people can't link to my script and use my account?

3. Any other suggestions for a fix?

I would post the code I am using here but I don't think its that relevant as I am more interested in fixing the integration rather than change the script.

Thanks for any help, I hope my description was clear enough.

[TheMadMidget]

answer to 1, use $_SERVER['HTTP_REFERER']

[ronverdonk]

HTTP_REFERRER cannot be trusted to be correct. Some providers do not make this available to users, mine included. See PHP doc on this at Predefined Variables

'HTTP_REFERER'
The address of the page (if any) which referred the user agent to the current page. This is set by the user agent. Not all user agents will set this, and some provide the ability to modify HTTP_REFERER as a feature. In short, it cannot really be trusted.

As to your question 2: ever thought of using a POST structure, like with cURL?

Ronald :cool: