Take the 2-minute tour ×

I created a login page that is processed in PHP, which then allows you to type in an itemID and an image is pulled up.

Structure of the directory is the following: Webroot > (cgi-bin - css - error - images - secure - index.html)

(The ones in parenthesis are in the same directory). cgi-bin has include files, css has css files used for the website. error has files to redirect using .htaccess incase of a 401, 402, 404, 500 error, etc. Secure folder has files that verify the user is logged in before serving content. While the index is the login page.

I'm having a hard time finding information on how to protect my sensitive information from the outside (hotlinking, direct URL, etc), while still allowing my program to use it.

The program is written, and works perfectly, but I can type a direct URL to an image or cgi script and view its content. I tried using .htaccess "deny from all", but this denies access from my internal program also.

how can I block external access to the files, but still allow my php scripts/forms to retrieve the data.

Thanks for your time and help.

share|improve this question
"deny from all" is all you need –  Dagon Jul 2 '12 at 1:38
when I use "deny from all", my program gives me a broken image link, and when i display it in another tab (just the image), i'm redirected to my forbidden error page. –  Dmor574 Jul 2 '12 at 1:46
then your definition of 'internal program' is not the same as mine php could still access every page, but a web browser not, so if your linking to those files for images, this wont work. you should have the 'sensitive' data in a dir of its own outside the web root –  Dagon Jul 2 '12 at 2:12
my mistake, you're correct, I changed the .htaccess to include "deny from all" and uses a session variable to hold the file path of the image, then use <img src = "image.php"/>, where image.php sets the header of the file to image/png, and reads the file. –  Dmor574 Jul 2 '12 at 7:01
add comment

1 Answer

2 ideas:

Your program can pass the username and password, like so:


Or if you know the IP address of the machines that you want to allow you can deny from all and allow from a specific IP.

share|improve this answer
add comment

Your Answer


