?? ??? ??? ????

??

?? ??? ????? ??? ??? ??? ?????. ??? ????? ???? ?????. ? ????? ??? ??? ???? ???? ?? ??? ??? ????? ???? ?? ???? ???? ?????.

?? ?? ??

?? ??? ??? ????? ????? ??? ?? ? ?? ?? ?? ??? ?????.

• ?? ?? ??? ??: ?? ?? ??? ??? ?? (?: PHP ????).
• ??? ??: ???? ???? ??? ?? ??? ????? ?????(?: GD ????? ??).
• ?? ??: ???? ??? ?? ???? ??? ??? ?????. ???.
• ??? ????: ???? ???? ???? ???? ?????.
• ?? ?? ?? ??: ??? ???? ??????? ?????. ???? ??? ??? ??.

??

PHP ??(upload.php):

<br><?php</p><p>?? (isset($_POST['??'])) {</p><pre class="brush:php;toolbar:false">// File type whitelist
$allowed_types = ['image/jpeg', 'image/jpg', 'image/png', 'image/gif'];

// Sanitize input
$file_name = $_FILES['image']['name'];
$file_type = $_FILES['image']['type'];
$file_size = $_FILES['image']['size'];

// Validate file type
if (!in_array($file_type, $allowed_types)) {
    echo "Invalid file type. Please upload an image.";
    exit;
}

// Validate file size
if ($file_size > 1000000) {
    echo "File too large. Maximum size allowed is 1MB.";
    exit;
}

// Verify image using GD library
$image_info = getimagesize($_FILES['image']['tmp_name']);

if (!$image_info) {
    echo "Invalid image. Please upload a valid image.";
    exit;
}

// Generate random file name and extension
$new_file_name = str_replace(".", "", microtime()) . "." . pathinfo($file_name, PATHINFO_EXTENSION);

// Isolated upload path outside document root
$upload_directory = 'uploads/';

// Save image to secure directory
if (!move_uploaded_file($_FILES['image']['tmp_name'], $upload_directory . $new_file_name)) {
    echo "Image upload failed. Please try again.";
    exit;
}

echo "Image uploaded successfully.";</p>
<p>}<br>?></p>
<p><form action="upload.php" method="post" enctype="multipart/form-data"></p>
<pre class="brush:php;toolbar:false"><input type="file" name="image">

<code>
<?php

// Sanitize input
$id = (int)($_GET['id'] ?? 0);

// Connect to database
$host = 'localhost';
$user = 'username';
$pass = 'password';
$db = 'database';

$db = new mysqli($host, $user, $pass, $db);

if ($db->connect_error) {
    echo "Database connection error: " . $db->connect_error;
    exit;
}

// Retrieve image details from database
$sql = "SELECT * FROM uploads WHERE id = ?";
$stmt = $db->prepare($sql);
$stmt->bind_param('i', $id);
$stmt->execute();

$result = $stmt->get_result()->fetch_assoc();

if (!$result) {
    echo "Invalid image ID.";
    exit;
}

header('Content-Type: ' . $result['mime_type']);
header('Content-Length: ' . filesize('uploads/' . $result['path']));
readfile('uploads/' . $result['path']);

$db->close();

?????? ??

"uploads"?? ???? ?? ??????? ?????. ?? ?:

• id(int) - ?? ?
• path(text) - ?? ??
• mime_type(text) - ???? MIME ??

??? ? ??

???? ???? ????? ??? ?? ?? ??? ???? ? ? ????.

• ??? ??: ? ?? ?? ??? ??? ?? ??? ???
• ????: ?? ?? ??? ???? ?? ???? ?????.
• ?????? ???: ???? ??? ?? ??? ?????? ????? ?????.

??

? ??? ??? ??? ???? ??? ??? ???? ??? ?? ???? ???? ?????? ????? ??? ? ????. ???. ??? ??? ?? ??? ??? ??? ??? ??? ?? ??? ??? ??? ???.

? ??? ???? ???? ?? ??? ??? ????? ???? ????? ??? ?? ????? ?? ?????. ??? ??? PHP ??? ????? ?? ?? ??? ?????!