image from url stored in db

[Goose87]

Hi all,

 

I have been looking around on the internet and I've only found one script that's any good and it appears to have no security related to it.

 

I am looking for a script that can let the user submit a url to display a picture (in my case, a profile picture).  The profile page will then pull up the picture from the url and display it when the page is loaded. 

 

My current method works quite simply:

 

The user can enter the url into the DB with a simple form.

The db then pulls that url out and displays it in the following way:

 

<img src='$url' height='200' width='150' alt='Avatar'> 

 

Basically like that.  It works fine... but.. I'm worried about the following few problems:

 

How can I stop various problems like people using links that are not image files.  Also, there might be other methods for people to manipulate the url method and cause huge problems.  If anyone can make me aware of it (and help with some code) as I am not very good with verification php, especially when it gets complicated!

 

Thanks in advance,

 

Goose.

[MadTechie]

It depends on exactly what you have an expect, in concept you could just pass the database records ID, then a simple

$ID =(int)$_GET['ID'];

would work

 

but without knowing what you have its very hard to say anything for sure!

[Goose87]

Maybe I need url validation for this?

 

I will have a post form to submit the data into the database.. so maybe I just need to validate it..

 

Anyone have any good code to validate images from say.. www.imageshack.us for example?

[oni-kun]

Maybe I need url validation for this?

 

I will have a post form to submit the data into the database.. so maybe I just need to validate it..

 

Anyone have any good code to validate images from say.. www.imageshack.us for example?

 

Can you not just extract the extension and validate it through that way? And if it were uploaded with Imageshack.us, I'm sure their serverside filtering has done the job for you.. If I get what you're asking.

 

function getExtension($str) {
         $i = strrpos($str,".");
         if (!$i) { return ""; }
         $l = strlen($str) - $i;
         $ext = substr($str,$i+1,$l);
         return $ext;
}

 

It won't allow for dynamic images, and you can only allow certain extensions once you validate them..

 

If you're paranoid than you can do something like this. Download the image or link to it and:

exec("identify $fullpathtoimage",$out);
        //using system() echos STDOUT automatically
        if(!empty($out)){
            //identify returns an empty result to php
            //if the file is not an image
            $info = $out[0];
            $info = explode(' ',$out[0]);
            $type = $info[1];
            if($type == 'JPEG' || $type == 'GIF' || $type == 'PNG'){
                return true;
            }
            }

 

And it'll return something such as "./image/someimage.jpg JPEG 150x112 150x112+0+0 DirectClass 8-bit 4.54688kb"

[Goose87]

There are two problems:

 

1) What if the person doesn't add an image shack url?  What if they add a www.blahblah.com/powned.exe or whatever.. i don't know what they could add, as I haven't studied this area..

 

2) I have NO idea about validation.. It's the other area I've failed in and I've had to had help with aspect.. even though I can code a game lol.  When it comes to text validation with all the {4-2} stuff and /*)(){} I get confused.. Could someone help me out and comment it possibly for me?  I'd be so grateful if you did..

 

Many thanks,

 

Goose.