Security through obscurity is a prominent placebo these days. If you don't want users deleting the wrong images, make the class/function/script that deletes them check for permission. Don't have your security dependant on the client. cheers, - Martin Norland, Sys Admin / Database / Web Developer, International Outreach x3257 The opinion(s) contained within this email do not necessarily represent those of St. Jude Children's Research Hospital. -----Original Message----- From: A.J. Brown [mailto:aj@xxxxxxxxxxxxx] Sent: Wednesday, September 28, 2005 7:48 AM To: Matthias Willerich Cc: php-db@xxxxxxxxxxxxx Subject: Re: Upload images with minimun effort from final user. . Matthias, The md5 approach is just added security, which is something I always use in situations like this. All it really does is mask it, so a user can't see what the ID is (or that it's a sequential number at all) and therefore view images they were not intended to see. For example, if the URL for viewing an image is as follows: /getimage.php?image=15 A user could guess that there are 14 other images, and could retrieve them by replacing the 15 with any other number. If you use the md5 approach, the url becomes this: /getimage.php?image=9bf31c7ff062936a96d3c8bd1f8f2ff3 This makes it harder for them to guess the image ID, and view images they are not inteded to see. Of course, this is not necessary by any means, and only applies when you're concerned with an image being viewed unintentionally. It's VERY usefull if you also have a public script which a user can delete an image using a similar url as above as well. Using the first example, if my page is /delete_image.php?image=15, a malicious user could delete EVERY image by just replacing the number. Sincerely, A.J. Brown BitNotion Technologies aj@xxxxxxxxxxxxx -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
