Member Avatar for dschuett

Hi all,

This may be asking a bit much, but this is my FIRST advanced PHP/MySQL project. Any help is appreciated.

I am currently building a website for one of my friends photography business, and she has requested to allow her clients to be able to sign with a username and password to view thier proofs - and then expiring the pictures/account after 30 days.

I know I could make separate pages for each user, but that cold turn out to be A LOT of work. I was just wondering if anyone knew of a good/fairly simple way to go about conquering this? Would I need to use mysql? I would like to use simple viewer to allow users to view their own pics like here for example: Just not sure how I would make it show THEIR pictures after they logged in with a username and password?

Thanks for your time!

  • 3 Contributors
  • 3 Replies
  • 134 Views
  • 17 Hours Discussion Span
  • Latest Post Latest Post by Lsmjudoka

Dani AI

Generated

Good start from (store filenames + metadata in a DB) and (sessions hold the logged-in identity). The missing pieces to make this safe, maintainable, and compatible with a viewer like SimpleViewer are: a small DB schema that includes an expiry timestamp, storing files out of the web root (or locking direct access), a protected image-serving endpoint that checks owner+expiry, and a dynamic viewer manifest that the viewer loads after login.

For example workflow and minimal code hints:

  • Schema (concept): photos rows hold id, user_id, filename, uploaded_at, expires_at, mime, size, width, height. Set expires_at at upload (uploaded_at + 30 days).
  • Fetch images for the logged-in user with a parameterized query (PDO/MySQLi) and only return non-expired items:
$stmt = $pdo->prepare(
  'SELECT id, filename, original_name FROM photos WHERE user_id = :uid AND expires_at > NOW()'
);
$stmt->execute([':uid' => $userId]);
$images = $stmt->fetchAll(PDO::FETCH_ASSOC);
  • Serve images via a script (not by direct static linking). The script verifies the session user owns the file and that expires_at is still valid. Prefer sending an internal redirect header (X-Sendfile or X-Accel-Redirect) to let the webserver serve the binary; fallback to streamed PHP output when not available.
header('Content-Type: ' . $mime);
header('X-Sendfile: ' . $realPath); // when server supports it
exit;

Security and ops notes: use password_hash()/password_verify() for passwords (see PHP docs: https://www.php.net/manual/en/function.password-hash.php), always use HTTPS, regenerate session IDs on login, set Secure/HttpOnly cookie flags, and follow the OWASP session management guidance (https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html). Run a daily cron to remove expired files/DB rows (example cron: 0 3 * * * /usr/bin/php /path/to/cleanup.php). Finally, generate the viewer’s XML/JSON manifest dynamically from the protected endpoint so each logged-in client only receives their own images.

Recommended Answers

All 3 Replies

Member Avatar for Member #120589

OK simple. Your uploaded photos are saved to a folder with a unique filename, e.g.
unixtimestamp_userid.fileextension

This filename is saved to mysql db record along with other file info, like title, description, tags, user_id, date_uploaded, filesize, dimensions etc.

When a user logs in the user_id (an integer from the user_id PK field in your users table) is propagated via sessions ($_SESSION variables) from page to page.

When a user wants to see their own uploads, they go to your generic view_photos.php (or similar) page which filters records from the DB based on the user_id (from session variable):

$user_id = $_SESSION['user_id'];
$r = mysql_query("SELECT photofile, description, ..(etc).. FROM photos WHERE user_id = '$user_id'");

In your while loop - you get the filenames from the photofile field. You build up a list of photos with associated details. You can present this in a html table.

This is very straightforward, but if you're a beginner, take some time to research how to display a html table with records from a db. Clue:

$output .= "<tr><td><img src=\"/photos/{$row['photofile']}\" /></td><td>" . stripslashes($row['title']) . "<br />" . stripslashes($row['description']) . "</td></tr>";

BTW stripslashes if you used addslashes, otherwise if used mysql_real_escape_string no stripslashes required.

Edited by Member #120589 because: n/a
Member Avatar for dschuett

Thanks so much for your reply, Everything makes sense except for the session - i haven't ever worked with sessions before. How exactly does that work? Will this ONLY allow that logged in user to access those pictures? Sorry, I haven't had any time today to try to get any code together. I will hopefully have something tomorrow!

Member Avatar for Lsmjudoka

(Following explanation assumes cookie-based sessions)

When you start a session, a cookie with a unique session id gets stored in the user's browser. Then every page load, the browser gives the script( session_start(); to be specific) that id, and it's matched up with the data($_SESSION in this case).

The id is unique to that computer/browser/time(until the user closes the browser), so yes, only that user will be able to access their pictures. (assuming there are no flaws in your login and display scripts).

Edited by Lsmjudoka because: n/a
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.