index.'); // Print a Content-type header to tell the browser // that we're sending it image contents header("Content-type: image/jpeg"); // Whitelist what sort of file the user can ask for if (preg_match('/^[a-zA-Z0-9_-]+\.jpg$/i', $_GET['filename'])) // Get the picture and print its contents out echo file_get_contents('/uploads/' . $_GET['filename']); ?>