Topic awaiting preservation: PHP img hosting script

In the past i have offered a photo hosting service for members of my site, so they can show pictures of their Minis (the car ) on various messageboards. Since then, I have started up a great forum of my own for the site. Many members use the photo hosting for showing pics on other forums, but don't really support our site..

I whipped this script up to limit the photos to the miniportal site's forums. It seems to work pretty good... but what do you think about it?

<?

//2002

//Justin Beaulieu



//Photo Hosting Script

//This script takes an image name (location) and if it's being veiwed from Mini Portal

//it will show the image. If it's being veiwed from another site, it will be replaced

//with the replacement image.



$imagebad = "images/offsite.jpg";				//replacement image

//$image = "images/test.jpg";				//the image - this was used for testing.. it will be passed in the url

							//.. like this: img src="miniportal.ca/members/img.php?image=justin_mini	

$image = "images/".$image.".jpg";				//add jpg extension

$needle = "miniportal.ca";						

if(strstr($HTTP_HOST, "$needle")){				//look for miniportal.ca in the http host (page url that is calling img)

	$src = ImageCreateFromJpeg($image);		// ... and if its there, show the img

}else{

	$src = ImageCreateFromJpeg($imagebad);		// ... or replace the img with ours

}

Header("Content-type: image/jpeg");				//send the header

ImageJpeg($src,'',75);					//show the image

Imagedestroy($src);					//done.



?>

thanks

--Lurch--

Not to be a pain, but couldn't you just use a mod_rewrite in an .htaccess to accomplish this? Something like:

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?domain.com.*$ [NC]
RewriteRule \.(gif

just a quick note, you should really check the path to the image that will get passed via the url.
I could in theory open any file on your server with it the way it is written now.
(oh, and you could serve some server time by just fputthroug()ing the image in question.
No need to actually read the jpeg, just pass it along. (of course, the way you do it now add's a little
security, while requiring a lot more server power).

so long,

Tyberius Prime