Question: I am trying to secure my PHP Image upload script and the last hurdle I have to jump is making it so that users cannot directly excecute the images, but the server can still serve them in web pages. I tried changing ownership and permissions of the folders to no avail, so I am trying to store the images above public\_html and display them in pages that are stored in public\_html.

My File Structure:

```
 - userimages
   image.jpg
   image2.jpg

 - public_html
   filetoserveimage.html

```

I tried linking to an image in the userimages folder like this:

```
<img src="../userimages/image.jpg">

```

But it does not work. Is there something I am missing here? If you have any better suggestions please let me know. I am trying to keep public users from executing potentially dangerous files they may have uploaded. Just as an extra security measure. Thanks!

Answer: 
You want something that's basically impossible. 

The way a browser loads a page (in a very basic sense) is this:

Step 1: Download the page.
Step 2: Parse the page.
Step 3: Download anything referenced in the content of the page (images, stylesheets, javascripts, etc)

Each "Download" event is atomic.

It seems like you want to only serve images to people who have just downloaded a page that references those images.

As PHP Jedi illustrated, you can pass the files through PHP. You could expand on his code, and check the HTTP\_REFERER on the request to ensure that people aren't grabbing "just" the image.

Now, serving every image through a PHP passthru script is not efficient, but it could work. 

The most common reason people want to do this is to avoid "hotlinking" -- when people create image tags on other sites that reference the image on your server. When they do that, you expend resources handling requests that get presented on someone else's page.

If that's what you're really trying to avoid, you can use mod\_rewrite to check the referer.

A decent-looking discussion of hotlinking/anti-hotlinking can be found [here](http://www.dagondesign.com/articles/hotlink-protection-with-htaccess/)
I think your misunderstanding is in the fact that if you include an image in an `<img>` tag, your browser will send the exact same request to the webserver to fetch it, that will be sent to the webserver if you try to open the `src` url of the image in your browser directly.

Therefore, either both things work, or neither.

There are hacks around, involving a (php or other) script to make sure that an IP that has requested the image has also requested the html page within the last few seconds (which will not work if the user is behind a proxy that rotates outgoing IPs) or by checking the referer (which does not work with HTTPs and also not if the user has referer disabled).

If you want to make sure that only some users can see the image (both via `<img>` tag and directly), you can put the image outside public\_html and have a (php or other) script that verifies the user's credentials before serving the image.