问站点根目录上的成员图片

EN

<?php

// presuming this file is in the root of your site
// define some directory where the actual images are
$dir = realpath( dirname( __FILE__ ) . '/../profile-images' );


// presuming this file is called with something like
// image.php?profileImage=fireeyedboy.jpg
if( isset( $_GET[ 'profileImage' ] ) )
{
    // strip all possible redundant paths
    // you should probably sanitize even more (check valid extensions etc.)
    $profileImage = basename( $_GET[ 'profileImage' ] );

    if( $someConditionsThatVisitorIsAllowedToViewThisImageAreMet )
    {
        // presuming mime type jpeg for now
        header( 'Content-Type: image/jpeg' );
        readfile( $dir . '/' . $profileImage );
        exit();
    }
    else
    {
        // conditions are not met, dish out HTTP/1.1 403 Forbidden header
        header( 'HTTP/1.1 403 Forbidden', true );
        exit();
    }
}