当php文件在doc root之外时，如何使用图像生成php

Question

I have a file, showcaptcha.php, that outputs an image.

I was referencing it like this:

<img src='/security/showcaptcha.php'>

It worked fine, so no problem with the code inside showcaptcha.php.

However, now I moved that php file outside doc root for security reasons. Putting php files outside doc root is good practice b/c it makes it harder for hackers to access any source code.

but now, what do I put in the src of my img?

<img src='???showcaptcha.php'>

or

<img src='<?php echo ??? ?>'>

Answer 1

Put your real code in a directory that is in the PHP include path (which is outside of the document root) and leave a stub in the security directory that does nothing more than require('showcaptcha.php');. Someone digging around is only going to know that that file exists someplace but if they are in the document root they won't be able to see or find it.