How can I access a file which is out of document root?

Question

Here is my code:

// captcha.php

<?php
session_start();

  $min=0;
  $max=9;
  $captcha_token='';
  for($i=1; $i<=5; $i++){$captcha_token .= rand($min,$max).' ';}
    $_SESSION['captcha'] = str_replace(" ","",$captcha_token);


$im = imagecreatetruecolor(110, 34);
$red = imagecolorallocate($im, 245, 245, 245);
imagefill($im, 0, 0, $red);
$text_color = imagecolorallocate($im, 80, 80, 80);
imagestring($im, 8, 15, 9, $captcha_token, $text_color);
header('Content-Type: image/jpeg');
imagejpeg($im);
imagedestroy($im);

?>

And I use it like this:

<img src="../../files/captcha.php" class="captcha_pic" alt="Captcha" />

It works as well. As you know, that is a http request. I mean I can open that image like this:

http://localhost/myweb/files/captcha.php

Now I want to change the place of file directory and put it out of the document root. So I cannot access captcha.php through a http request. I have to use absolute path to get it. How?

Noted that this doesn't work:

<?php
    $img = include __DIR__ . "/../../files/captcha.php";
?>
<img src="<?=$img?>" class="captcha_pic" alt="Captcha" />

If I remember correctly, `__DIR__` doesn't have a trailing `/`. Did you try using `$img = include __DIR__ . "/../../files/captcha.php";` instead? — pgngp, Sep 10 '17 at 04:58
@pgngp You're right, but look, I've tested *(almost)* all paths. So the problem is something else. I guess the problem is related to initializing `include()` to a variable. — Martin AJ, Sep 10 '17 at 04:59
You won't be able to specify a path outside the document root in a tag. If you want to feed a file from **below** the root, you will need to use [readfile()](http://us.php.net/readfile) with proper calls to `header()` prior. — mseifert, Sep 10 '17 at 05:14
Does `../../` put you below root? If so, see my comment above. Also, you cannot use absolute paths in a url (http request) - they are for server side file reference only. If you want to specify the full path, you are starting with `http://localhost` then add your path. e,g `http://localhost/path/to/files/captcha.php` — mseifert, Sep 10 '17 at 05:29

Progrock · Answer 1 · 2017-09-10T06:52:29.823

You could place your functionality in a file, that you then include and use to generate a base64 encoded data image:

<?php
function createBinaryImageCaptcha($text) {
    $im = imagecreatetruecolor(110, 34);
    $red = imagecolorallocate($im, 245, 245, 245);
    imagefill($im, 0, 0, $red);
    $text_color = imagecolorallocate($im, 80, 80, 80);
    imagestring($im, 8, 15, 9, $text, $text_color);
    ob_start();
    imagejpeg($im);
    imagedestroy($im);

    return ob_get_clean();
}

function createDataImage($binary) {
    return 'data:image/jpeg;base64,' . base64_encode($binary);
}

Then require above that you can place where you like. To use:

$img = createDataImage(createBinaryImageCaptcha('helloearth'))
?>
<img src="<?= $img ?>" alt="captcha text">

Bear in mind that not all browsers support data uris for images.

Which browsers support data URIs and since which version?

And please consider captcha accessibility.

How can I access a file which is out of document root?

1 Answers1