PHP - 如何设计安全的照片库文件结构

Question

I've decided not to use a BLOB to store the image for my gallery. I've created a directory structure (with no DB transactions at all)... its pure file system. For example i've created the following file structure:

http://www.mywebsite.com/Client_IMAGES/female/S/10f6f9b0d880ab3bd2c9c81fb33f8be59e09d9ed/MY_IMAGE.jpg

The folder is divided into male and female. The letter "S" being the first letter of the email address and the hash being unique to each user. So if you can see what im doing is making a easy to search file structure. My concern is on security. I've updated my .htaccess file to include option-indexes which means no directories will be directly shown but is this the best way to be doing this ? i see other sites using CGI and a photoID etc ..i need some guidance.

Answer 1

If you want to keep the photos secure, I would suggest taking all of them out of your web root and possibly having a rewrite rule so that .jpg, .gif, .png, whatever are redirected to a script that does something like

$file = "/path/to/files/$_REQUEST[file]";
if (user_can_see($file)) {
   header("Content-Type: " . mime_content_type($file));
   readfile($file);
}
else {
   die("Hmm?");
}