title: Proper method of storing private images on server?
body: <p>I have written a PHP script to retrieve images that are NOT under the public_html folder. The script authenticates the user has permission to view the image then displays it. The image permissions are set to "0755"<BR><BR>
  Is this a secure method to prevent other people from viewing private images? Would hashing the image file name add any security benefit? Are there any other alternative methods that could improve this script?</p>
  
  <p>script of image_retrieval.php</p>
  
  <pre><code>&lt;?php
  include '../user_verification.php';
  $image_request = $_GET['image_request'];
  $pic = file_get_contents("/home/username/images/'.$image_request.'");
  header('Content-type: image/jpeg');
  echo $pic;
  ?&gt;
  </code></pre>
  
  <p>script of display_image.php</p>
  
  <pre><code>    &lt;?php
  include '../world/verification.php';
  $image_request = $_GET['image_request'];
  echo"&lt;img src='http://www.domainname.com/request_image.php?userid=$userid&amp;image_request=$image_request'&gt;";
  ?&gt;
  &lt;form id='image_requester' method='get' action='display_image.php'&gt;
      &lt;input type="text" id="image_request" name="image_request"&gt;
      &lt;input type="hidden" value="&lt;?echo"$userid";?&gt;" id="userid" name="userid"&gt;
      &lt;input type="submit" value="request"&gt;
  &lt;/form&gt;
  </code></pre>