Custom Image Code - Need Security

[Rawhide]

I'm working on some custom image code, not unlike the [img] tag.

What is the best way to ensure that:
a) the url starts with http:// (not https://)
b) the filetype is .jpg, .gif or .png
c) the url contains no spaces, <, >, ?, $, &, [, ], html, or other symbols that could be harmful
d) the url only contains letters, numbers, /, and .
e) if possible, information on how to check to see that the image is a valid image file
f) not required, but information on how to implement dimension checking would be useful too

If anyone could assist me with the best way of doing these, it would be much appreciated.

[Rawhide]

Even if you can only answer one of these queries, or part of one, any assistance would be appreciated.

[Viper007Bond]

e) Not possible without using PHP to download the image file and then examine it with some image functions from the GD module.

As for the rest, something like this would probably do I think:

PHP Code:

$text = preg_replace('#\[yourtag\]http://([A-Za-z/.]+)\.(jpg|gif|png)\[/yourtag\]#si', '<img src="http://$1.$2" alt="" />', $text); 


[Rawhide]

Thank you! I haven't used your code specifically, but it was exactly what I needed to know.

Because this is going in a user profile field, I haven't needed to specifically write php code for it, instead I used the preg_match feature of the user profile field. Below is the characters I am currently allowing, I have added 0-9, ~, _ and - and allowed for a blank entry.

PHP Code:

^http://([A-Za-z0-9/.~_-]+)\.(jpg|gif|png)$|^$ 


It now supports the ability to set the image dimensions between 20 and 120 pixels with the below regular expression on two other mandatory user profile fields.

PHP Code:

^([2-9][0-9]|11[0-9]|120)$