Member Avatar for Stefce

How do i get the name of the image without the extension at the end ex. (.jpg) i got this code

functions.php

function get_image($id="1") {
?>
    <img class="img-responsive img-portfolio img-hover" name="picture" src="images/gallery/<?= urldecode(base64_decode($id)); ?>" alt="">
<?php
}

pictures.php

<center>
    <form action="" method="POST">
        <div class="col-lg-12">
            <?php
                get_image($imageID); // $imageID is read from database
            ?>
        </div>
    </form>
</center>
Edited by Stefce
  • 2 Contributors
  • 2 Replies
  • 584 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by cereal

Dani AI

Generated

A concise, safe approach and a few cautions.

Extracting the visible name (filename without its extension) is best done with PHP’s pathinfo(..., PATHINFO_FILENAME). That solves cases with multiple dots (e.g. photo.v1.jpg -> photo.v1). However, the bigger issue in this thread is input safety: is passing base64-encoded filenames in the URL and correctly warned about path traversal. Base64 only encodes; it does not validate or confine paths. Two practical, safer patterns follow.

Safe decode + extract (keep filenames in the gallery folder only):

$raw = isset($_GET['imageID']) ? base64_decode($_GET['imageID'], true) : false;
if ($raw === false) { /* invalid id / 404 */ }

$filename = basename($raw);                       // strip any directories
$ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
$allowed = ['jpg','jpeg','png','gif'];
if (!in_array($ext, $allowed, true)) { /* reject */ }

$name = pathinfo($filename, PATHINFO_FILENAME);   // filename without extension
echo htmlspecialchars($name, ENT_QUOTES, 'UTF-8');

Prefer an ID-to-filename mapping when possible (avoids exposing filesystem names):

$files = array_values(array_diff(scandir($galleryDir), ['.','..','index.html']));
$id = isset($_GET['id']) ? (int) $_GET['id'] : -1;
if (!isset($files[$id])) { /* 404 */ }
$filename = $files[$id];
$name = pathinfo($filename, PATHINFO_FILENAME);

Extra protections: confirm the resolved file is inside the gallery (realpath checks), verify MIME with finfo_file() so only images are served, keep an extension whitelist, and always escape output for HTML. For user-friendly labels, consider storing a separate display name in the database instead of relying on raw filenames.

Recommended Answers

All 2 Replies

Member Avatar for Stefce

Sorry my mistake the variable $imageID is not taken from database its $_GET Method from URL in another function:

function img($path) {
    $folder = "images/$path";
    $i = 0;
    if (is_dir($folder)) {
        if ($handle = opendir($folder)) {
            while (($file = readdir($handle)) != FALSE) {
                if ($file === "." || $file === ".." || $file === "index.html") { continue; }

                ?>
                    <div class="col-md-4 img-portfolio">
                        <a href="pictures.php?imageID=<?= base64_encode($file); ?>">
                            <img class="img-responsive img-hover" src="<?= $folder ?>/<?= $file ?>" style="width: 350px;
                            height: 350px;" alt="">
                        </a>
                    </div>
                <?php

            }
            closedir($handle);
        }
    }
}

and than passed in pictures.php file as
<?php $imageID = $_GET["imageID"]; ?>

Edited by Stefce
Member Avatar for cereal

Hi! You can use pathinfo() or a directory iterator:

$ext = pathinfo($file)['extension'];

BUT right now the img() function can, potentially, allow the access to the contents of any directory on the server, by adding ../ to the variable, as example you can write the following and access /etc/:

pictures.php?imageID=images/../../../../etc

It depends on the position of the document root in the file system. You could use an integer and make sure it's valid, for example:

$imageID = filter_input(INPUT_GET, 'imageID', FILTER_VALIDATE_INT, ['options' => ['default' => NULL]]);

if(TRUE === is_null($imageID))
{
    # redirect or show 404
}

# continue if $imageID is valid

See also: https://www.owasp.org/index.php/Path_Traversal

commented: thank you @cereal +2
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.