Ever found one of your images on someone else’s site? Then to add insult to injury you find that they’ve actually linked your image directly from their page so you’re paying for the bandwidth for them to display your image on their own page? Bandwidth bandits!

Well here’s a way to write a message across the centre of the image, if the image has been loaded from any site but your own. To do this we need to create 2 files. One is an .htaccess file for use in Apache and the other is a PHP script. Apache must have the mod_rewrite module enabled and PHP must have been compiled with the GD library for this to work.

The following .htaccess file should be dropped in to the root docs folder of your web site. It contains rules that tells Apache to check the referring domain on any file that contains a jpg, gif or png extension. If the referrer is codexsoftware.co.uk, friendlysite.com, google.com or Google’s cache then it’ll serve the image as normal. If it isn’t then it’ll redirect the request to imagehotlink.php in the document root. You should edit these domains for your own site. Remember to put the backslash before all dots in your domain names.

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} .*jpg$|.*gif$|.*png$ [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !codexsoftware\.co\.uk [NC]
RewriteCond %{HTTP_REFERER} !friendlysite\.com [NC]
RewriteCond %{HTTP_REFERER} !google\. [NC]
RewriteCond %{HTTP_REFERER} !search\?q=cache [NC]
RewriteRule (.*) /imagehotlink.php?pic=$1

Then all we need to do is drop the following imagehotlink.php file in to your document root. It will load the requested image and write the contents of the $text variable across the centre of the image in as large a font as it can – adjust the text to your amusement

<?php
$pic = strip_tags( $_GET['pic'] );
if (!$pic)
	trigger_error("No picture specified.", E_USER_ERROR);
$path_info = pathinfo($pic);
switch ($path_info['extension']) {
    case 'gif':
        $image = imagecreatefromgif($pic);
        break;
    case 'png':
        $image = imagecreatefrompng($pic);
        break;
    case 'jpg':
    case 'jpeg':
        $image = imagecreatefromjpeg($pic);
        break;
}
if (!$image) {
    header("HTTP/1.0 404 Not Found");
    exit;
}
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
header("Cache-Control: no-store, no-cache, must-revalidate");
header("Cache-Control: post-check=0, pre-check=0", false);
header("Pragma: no-cache");
header("Content-type: image/png");
$color_text = imagecolorallocate($image, 255, 255, 0);
$color_shadow = imagecolorallocate($image, 0, 0, 0);
$color_bg = imagecolorallocate($image, 0, 0, 50);
$text = "http://www.codexsoftware.co.uk/ pwns this site";
$ypos = imagesy($image) /2;
$font_size = 5;
$text_width = imagefontwidth($font_size)*strlen($text);
while (($text_width > imagesx($image)) && ($font_size > 2)) {
    $font_size--;
    $text_width = imagefontwidth($font_size)*strlen($text);
}
$xpos = ceil(imagesx($image)/2) - ceil($text_width/2);
imagefilledrectangle($image, 0, $ypos,iagesx($image), $ypos + imagefontheight($font_size), $color_bg);
imagestring($image, $font_size, $xpos+1, $ypos+1, $text, $color_shadow);
imagestring($image, $font_size, $xpos, $ypos, $text, $color_text);
imagepng($image);
imagecolordeallocate($image, $color_text);
imagecolordeallocate($image, $color_shadow);
imagecolordeallocate($image, $color_bg);
imagedestroy($image);
?>

This code was inspired by this excellent article http://www.alistapart.com/articles/hotlinking/ It has a good explanation of the .htaccess rules and how referrers work, but I liked the idea of returning a modified image rather than an HTML block as it allows me to write amusing messages across bandits’ web pages.