如何保护用户在我的网站上上传的私人照片？
我正在使用 PHP/MySQL 来处理图像上传。我希望上传到登录用户图库的所有图像只能由登录用户访问。我不希望人们能够猜测文件名并直接链接到它。
我想我可以将图像存储在 webroot 之外并通过一些 PHP 访问它们。但是，如果用户想稍后通过链接与朋友分享图像，我该如何允许呢？
我还需要采取其他步骤来确保只有用户才能看到他们的照片吗？我非常重视用户隐私并希望做好这一点。
提前感谢您的帮助！
I am using PHP/MySQL to handle the image uploading. I want all images that are uploaded to the logged in user's gallery to only be accessible by the logged in user. I do not want people to be able to guess the file name and directly link to it.
I am thinking that I can just store the images outside the webroot and access them through some PHP. However, if the user wants to later share the image with a friend via a link, how would I allow that?
Are there any other steps I need to take to make sure only the user can see their photos? I take user privacy very seriously and want to get this right.
Thanks for your help in advance!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
你原来的假设是正确的。将文件存储在公共目录之外，并使用 PHP 脚本检查授权并显示图像。
为了解决共享问题，您可以给他们一个区域，他们可以在其中说“共享这张照片”，它将显示一个像
XA21IW 这样的 URL，它是存储在表中的一些唯一哈希值，他们可以指定生命周期，或者您可以自己编写一个生命周期。当页面加载并传入 v 时，您可以查找表以确定它是否是该图像 ID 的有效哈希值。
您在这里有一些选择。每次他们单击“共享此照片”时，您都可以：
或者只是允许图像公开/私有。
You are correct in your original assumption. Store your files outside of the public directory and use a PHP script to check authorization and display the image.
To get around the sharing problem you can give them an area where they can say "Share this photo" and it will display a URL like
XA21IW would be some unique hash stored in a table and they can specify a lifetime or you can code one yourself. When the page loads and v is passed in you can lookup a table to determine if it is a valid hash for that image id.
You have some options here. Every time they click "Share this photo" you can:
Or simply allow images to be public/private.
您可以使用基于配置文件（用户）的共享系统，其中登录用户 A 可以指示登录用户 B 有权查看图像 C，并且可以随意添加/删除此类权限。
如果无法将查看链接到用户帐户，您可以对图像或图像组（例如图库）设置“查看密码”；查看图像的 URL 将检查用户/所有者是否是查看者，如果不是，则会要求输入密码。
You could use a profile(user)-based sharing system, where logged-in user A can indicate that logged-in user B is allowed to view image C, and can add/remove such permissions at will.
If linking viewing to a user account is not possible, you could have 'view passwords' on the images or on groups of images (such as a gallery); the URL to view the images would check if the user/owner is the one viewing and if not, it would demand the password.
我认为将图像存储在 webroot 之外并通过一些 PHP 访问它们是没有问题的。当用户共享它时，您始终可以使用 php 脚本访问它们..即使这样做更安全，因为您始终可以执行一些安全检查。在实际显示图像之前。
谢谢。
I think there is no problem is storing the images outside the webroot and access them through some PHP. You can always access them with the php script, when ever user shares it.. even it is more secure to do so, beacuse you can always perform some security checks. before actually displaying the image.
Thanks.
您将图像保存到您的服务器，放置图像名称，您需要的数据以及数据库中的一些散列......
比您将图像的路径设置为名为 images.php 的 php 文件，您可以在其中使用 GET 接收此哈希，并通过哈希从数据库中查找图像，并将标头设置为 image/GIF 示例创建图像。图像的路径将为 images.php?hash=abcdefg。
其他人考虑用户权限，所以...我认为这个解决方案有一些回应...这很简单...
You save image to your server, place image name, data what you need and some hash in you DB ....
than you set path of image to php file called images.php where you receive this hash with GET and find image by hash from you DB and with header set to image/GIF example create image. Path to image will be images.php?hash=abcdefg.
Other thinks about user permission and so... I think there are some responds with this solutions... it is quiet easy...