storing images outside of public_html

[eluser]Jelmer[/eluser]
There's more wrong with the code.

The following does nothing usefull:

Code:

$server_request = str_replace('../../system/uploads/', '', $_SERVER['REQUEST_URI']);

That statement used to read:

Code:

str_replace('../', '', $_SERVER['REQUEST_URI']);

Because it is meant to replace any previous directory requests (../) by the user to prevent them from requesting anything they like. I presume that '../../system/uploads/' in general won't be in the request URI, so replacing it is kinda useless.

Code:

$file = '../../system/uploads/feb09-001.jpg';

The fixed file is for testing I presume?