文件和文件夹访问管理和安全性（PHP / Apache）

Question

I have a PHP website and I want to make sure that only logged in users can access certain data and that users can only access data the have clearance to access. I'm not really sure if this is a PHP or Apache issue. Let's say the folder "Images" exists on the server. If the user is not logged in and the browser requests can image from the folder, would a redirect to another page take care of it or do I need to involve Apache somehow to make sure that the user absolutely can't access the files unless there is a PHP session which identifies the user?

Answer 1

Use php to verify the user and use an .htaccess file to deny any access to that directory which isn't sent from php. However, if you use the .htaccess method, you'll have to get the image with php, it won't be accessible with html or javascript. Put an .htaccess file in the image folder:

deny from all

With that written inside of the .htaccess file.

Then only php can access the files inside of the folder.