PHP response-header tricks

Question

index.php:

<style type="text/css">
img {
width: 50px;
}
</style>

<iframe name="myPHPScript" src="header.php" width="50%" 
frameborder="0"> 
</iframe>

<iframe name="myPHPScript" src="header.php" width="50%" 
frameborder="0"> 
</iframe>

<iframe name="myPHPScript" src="header1.php" width="50%" 
frameborder="0"> 
</iframe>

header.php:

<?php header("Content-type: image/png");
$img1 = file_get_contents ("3.png");
echo $img1;
?>

header1.php:

<?php header("Content-type: image/png");
$img2 = file_get_contents ("test1.jpg");
echo $img2;
?>

By this method I can call multiple images, but this is not what I expect, I would like to get the same result with only 1 php file.

Answer 1

You could use a URL parameter.

<iframe name="myPHPScript" src="header.php?id=0" width="50%" 
frameborder="0"> 
</iframe>

<iframe name="myPHPScript" src="header.php?id=0" width="50%" 
frameborder="0"> 
</iframe>

<iframe name="myPHPScript" src="header.php?id=1" width="50%" 
frameborder="0"> 
</iframe>

The PHP script uses $_GET['id'] to determine which image file to return.

<?php 
header("Content-type: image/png");
$images = ["3.png", "test1.jpg"];
if (isset($images[$_GET['id']])) {
    readfile($images[$_GET['id']]);
}
?>

An alternative to this would be to have PHP return a single image that contains all your images concatenated, and use CSS sprites to show different parts of it.

Answer 2

There is no "trick". You cannot "prevent users from getting images".

Every server-side resource, that means images, HTML pages, stylesheets, everything, needs to have a URL by which they can be downloaded. The browser makes a request to download a URL, receives the response to that request, and then treats it accordingly as an HTML page, image, or whatever else.

You cannot have one URL return two different things. I mean, you can, your server could randomly return different content each time the URL is being accessed. But that's pretty nonsensical. If you want your visitors to see your image, you will need to give them one unique URL where they can do so. If you don't want your visitors to see your image, don't put it online.

If you do let your visitors see your image, that means they need to download it to their computer. They need a URL for that. Your visitors don't care at all whether that URL ends in .php or .jpg. All they know is that a request to that URL will return that image. Your "trick" doesn't do anything. You still end up with a URL from which an image can be downloaded.

Once the image is downloaded and the visitor can see it, it's on their computer. You can't prevent user's from getting the image yet also see the image. What you want is nonsense.

_{(This answer may seem somewhat rambling, but addresses the original revision of the question.)}

Answer 3

Another way to show multiple images with one call is to instead of returning a single image return the HTML that contains the multiple images. For example you would call your php file and return this:

  <img src="data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg=="/>
  <img src="data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg=="/>
  <img src="data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg=="/>
  <img src="data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg=="/>

Where instead of links you put the image data directly in the SRC as base64 encoded data.

As others noted though, it won't prevent someone from copying the image.

A great example why is even using ctrl+prtsc. Even if we ignore things like the browser cache etc.. One could just screenshot the image.

---

As I mentioned in the comments, you can prevent the PHP file from returning the image if someone is (say) not logged in. This would prevent direct links back to your website. Which in some cases has valid reasons, the example I used was a Mail order bride site. Some profile images were publicly visible other were not (not without an account). This wasn't more of an "Adult" content issue in this case and so there was a legal responsibility to not show some of the images to the general public or have them linked back to the site directly.

But again this doesn't prevent someone from copying the image and sharing it publicly.