file_get_contents() help

[greens85]

Hi All,

 

In the interest of tightening my site security I have recently altered the way in which certain images are viewed within my application.

 

I was originally using the following:

 

if(!empty($row['CRB_img'])) {
echo "<a href=\"../Teachers/CRBs/$row[CRB_img]\" rel=\"lightbox\">
<img src=\"images/view_crb_icon.png\" title=\"View CRB\" /></a>";
}

 

But I have now altered it to use file_get_contents() which I have got working, but now instead of opening the image in a lightbox on the same page, it opens it in a different page.

 

What I want to do is use file_get_contents but have it open in a lightbox on the orginal page.

 

Original Page: my_profile.php

New Page: CRB_image_permission.php

 

my_profile.php contains the link to the view the CRB and CRB_image_permission.php is where the get_file_contents is.

 

The code for CRB_image_permission is:

 

<?php
session_start();
ob_start();
include("teacher_includes/session_check.php"); 
include("../includes/database_connection.php");

$qry = "SELECT * FROM teachers WHERE username = '$username'";
$rst = mysql_query($qry) or die (mysql_error());
$row = mysql_fetch_array($rst);
$teacherid = $row['teacher_id'];

$CRB_Number = mysql_real_escape_string(htmlspecialchars($_GET['crb_number']));

$file_extension = pathinfo($CRB_Number);
$file_extension = $file_extension['extension'];

$query = "SELECT * FROM crb_information WHERE teacher_id = '$teacherid' AND CRB_img = '$CRB_Number'";
$result = mysql_query($query) or die (mysql_error());
$row = mysql_fetch_array($result);
$count_rows = mysql_num_rows($result);

if($count_rows == 1) {

	switch ($file_extension) {

		case "jpg":
			header('Content-Type: image/jpg');
			echo $img = file_get_contents('../Teachers/CRBs/'.$CRB_Number);
			break;
		case "jpeg":
			header('Content-Type: image/jpeg');
			echo $img = file_get_contents('../Teachers/CRBs/'.$CRB_Number);
			break;
		case "pjpeg":
		  	header('Content-Type: image/pjpeg');
			echo $img = file_get_contents('../Teachers/CRBs/'.$CRB_Number);
			break;
		case "gif":
			header('Content-Type: image/gif');
			echo $img = file_get_contents('../Teachers/CRBs/'.$CRB_Number);
		default:
			echo "default";

	}

} else {

	$_SESSION['permission_error'] = "<font color=\"red\">You do not have permission to view that CRB</font><br /><br />";
	header("Location:my_profile.php");
	exit();

}

?>

 

Bit stumped on this one, can anyone advise.

 

Many thanks.

 

[EDIT]

 

Sorry should have probably also shown how I now link to the new page:

 

<?php
if(!empty($row['CRB_img'])) {
echo "<a href=\"CRB_image_permission.php?crb_number=$row[CRB_img]\">
<img src=\"images/view_crb_icon.png\" title=\"View CRB\" /></a>";
}
?>

 

[mrMarcus]

Seems you have removed:

 

 rel="lightbox"

 

from your <a>

[greens85]

Perfect, many thanks MrMarcus...

 

Didn't expect such a simple solution!

 

Many thanks once again