if you put your image in the public folder then anyone can see it. if you want to prevent anyone to see the image, then the image in another (unreachable) folder makes sense.
in the view, you image should be something like this:
<img src="/imageRender/<?= $someimage ?>" alt="image">
then you should have a route to serve this 'protected' images, like this:
$routes->match(['get', 'post'], 'imageRender/(:segment)', 'RenderImage::index/$1');
and finally the controller to serve the image:
<?php
namespace App\Controllers;
use CodeIgniter\Controller;
class RenderImage extends Controller
{
public function index($imageName)
{
if(($image = file_get_contents(WRITEPATH.'uploads/'.$imageName)) === FALSE)
show_404();
// choose the right mime type
$mimeType = 'image/jpg';
$this->response
->setStatusCode(200)
->setContentType($mimeType)
->setBody($image)
->send();
}
}
in the controller you should do some check on the request, like if whoever is requesting the image is logged in or has the proper permission to see the image, otherwise you are back in the 'public folder' example, where anybody can see the image (and so, why go through so much trouble? :P ).