通过php下载远程图像（安全）

Question

PHP:

Any ideas where I could find a script similar to what stackoverflow uses? Or would it be easy to make something like that myself? I'm sure downloading the image is not a problem, but I'm more worried about security. I'm building an user avatar upload/remote upload system.

Jquery:

The reason I added jquery to the tags, perhaps it is possible to let the user point the URL of the image and somehow upload it via the normal file upload input himself (without having to manually download the image to the computer first)

Answer 1

You can use cURL to download the image and then use getimagesize() to check whether it's actually an image - for security purposes.

<?php
$limit = 1024*1024*10 // Max. file size in bytes (1024*1024*10 = 10MB)
$ch = curl_init();

$fh = fopen('image.jpg', 'w'); 

curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FILE, $fh);
curl_setopt($ch, CURLOPT_RANGE, '0-' . $limit);

curl_exec($ch);

curl_close($ch);

if ($image = getimagesize ("image.jpg")) { 
     // It's an image
}
else { 
     // Not an image; delete!
}