Help with a Simple Image Viewer Script

[webref.eu]

Hi Guys

 

It's been a while since I've done any PHP coding, and I need a simple script to display the large version of an image, so for example, pass the script the following url: 

 

photo.php?photo=133

 

I need the script to:

 

- get the image ref, i.e. 133, so I can reference a large version of the image stored in the images/large/ folder.

 

- cleanse the variable, i.e. protect against any hacking attempt

 

I'm looking in to how to do this at the moment as I'm a bit out of practice, but as I understand this is basic stuff, if any of the pros can tell me the code, that would be much appreciated as it will save me some valuable time. 

 

Cheers

 

 

[fugix]

On your photo.php page, you will want to grab the query string variable using $_GET['photo']

The only "cleansing" of this variable that really needs done is to make sure that the variable passed through the URL is a numeric value.

$photo_id = $_GET['photo'];
if (is_numeric($photo_id))
{
// do something with the photo_id
} else
{ 
trigger_error('invalid photo id',E_USER_ERROR);
}

[TeNDoLLA]

If you have the image id as auto_increment in database it will be unsigned int, in which case it is better to check against

if (intval($_GET['photo']) > 0)
{
     // image id is valid
}

 

..since is_numeric can take some other values also than normal numbers like +0123.45e6 or hexadecimal notations.

[webref.eu]

fugix - Many thanks for your help, that's great.

 

TeNDoLLA - Thanks for your comments. 

 

Rgds

[fugix]

If you have the image id as auto_increment in database it will be unsigned int, in which case it is better to check against

if (intval($_GET['photo']) > 0)
{
     // image id is valid
}

 

..since is_numeric can take some other values also than normal numbers like +0123.45e6 or hexadecimal notations.

True, however intval gives unexpected results with integers. It's more designed for strings

[Pikachu2000]

Like all form data, $_GET['photo'] is a string.

 

The best way to validate that value would be with ctype_digit IMO, and cast it as an integer for use in the query string.

 

if( ctype_digit(trim($_GET['photo'])) ) {
     $photo_id = (int) $_GET['photo'];
     $query = "SELECT field FROM table WHERE photo_id = $photo_id";
} else {
     // possible attempt to pass an invalid value in URL
}