Question: I am trying to secure my PHP Image upload script and the last hurdle I have to jump is making it so that users cannot directly excecute the images, but the server can still serve them in web pages. I tried changing ownership and permissions of the folders to no avail, so I am trying to store the images above public\_html and display them in pages that are stored in public\_html.

My File Structure:

```
 - userimages
   image.jpg
   image2.jpg

 - public_html
   filetoserveimage.html

```

I tried linking to an image in the userimages folder like this:

```
<img src="../userimages/image.jpg">

```

But it does not work. Is there something I am missing here? If you have any better suggestions please let me know. I am trying to keep public users from executing potentially dangerous files they may have uploaded. Just as an extra security measure. Thanks!

Answer: 
Use an image relay script!

To serve a imagefile that is outside the public\_html folder you would have to do it by a php script. E.g make a image-relay.php that reads the image that is outside the public html...

```
<?php
header('Content-Type: image/jpeg');
$_file = 'myimage.jpg'; // or $_GET['img']
echo file_get_contents('/myimages/'.$_file);
?>

```

Now, $\_file could be a $\_GET parameter, but its absolutley important to validate the input parameter...

now you can make an `<img src="image-relay.php?img=flower.jpg">` to access a flower.jpg image that is located in /myimage/flower.jpg ...
I think your misunderstanding is in the fact that if you include an image in an `<img>` tag, your browser will send the exact same request to the webserver to fetch it, that will be sent to the webserver if you try to open the `src` url of the image in your browser directly.

Therefore, either both things work, or neither.

There are hacks around, involving a (php or other) script to make sure that an IP that has requested the image has also requested the html page within the last few seconds (which will not work if the user is behind a proxy that rotates outgoing IPs) or by checking the referer (which does not work with HTTPs and also not if the user has referer disabled).

If you want to make sure that only some users can see the image (both via `<img>` tag and directly), you can put the image outside public\_html and have a (php or other) script that verifies the user's credentials before serving the image.