The original message has been updated and reposted later in this thread. Please scroll down.

(When the forum software was updated, the original message had all brackets '(' and ')' changed to '&##;')

Thanks,
...jim

A quick update.

As I mentioned near the beginning of the first message, I've only been playing with PHP and web site programming since June '04.

I've just discovered a problem with this whole setup. It works fine for 99% of visitors, but does not work for the other 1%.

Why? Because I secretly hate them. Ok, no, that's not the reason. Actually, I recently discovered that there are users who go through proxy servers, and that some of those proxy servers will rotate through a bunch of IP's during a single visit to a web site. AOL is a fine example of this.

So what happens is that a visitor enters my site and their IP is logged. The visitor then goes to another page on my site, but because of the rotating proxy server, appears to be coming from a different IP. Since the new IP is not logged, they are bunted back to the home page.

I'd be a bit annoyed if that kept happening to me. So far, I've receive feedback from three people that this happens to them. Took me a couple of days to figure out what was going on.

I'm now on my fourth day of recoding my site to accomodate this newly discovered (for me) problem.

I'll post back when I've got it solved.

Still having fun,
...jim

A few weeks ago, it dawned on me that I could not use the usual .htaccess method of checking the referrer to prevent hotlinking to my .WMV video files, of which I have a substantial number. The reason for this is that using the .htaccess method prevents Windows Media Player from getting the file should WMP be invoked by Internet Explorer when the link to the file is clicked. This occurs on my Windows XP system with IE6. Why? Because Windows Media Player does not send any referrer information, which is what the .htaccess method relies on.

(There is more information regarding how WMP/IE6 behaves in this thread: http://www.lunarforums.com/forum/index.php?topic=22528.msg173975#msg173975 )

Since I couldn't use .htaccess to prevent hotlinking, and a quick search of the 'net didn't turn up anything, I decided to see if I could write something in PHP to take care of this little problem.

I have succeeded. A couple of people asked if would share how I did it. Not a problem, I like to share things. But, be warned, this is a kludge of the first order. It's not perfect, but it will do the job. I should also mention that I have been messing with PHP only since last June (2004), so there may be better ways to do some of the stuff I'm doing. However, I have been programming off and on since the mid '80's.

The Overview (or, what the heck am I doing, and why?)

I knew that PHP had functions to read in files and spit them out to a waiting browser. I also knew that PHP does not care what is in a .htaccess file. Armed with those two bits of information, I knew I could devise a routine that could read in the file and send it out, and that I could use a .htaccess file containing "deny from all" in the folder containing the video files to keep others out. What I also needed was a way to track who was doing what on my site. That's where MySQL comes in.

When a user hits my home page, a PHP routine checks to see if a non-persistant cookie containing a session ID has been set. If not, it generates a unique session ID and sticks it into a database record, along with the name of the page that is being sent, as well as the current time, twice, once as the start time, and once as the current time. At the same time, a non-persistant cookie is set containing the generated sessionID. A redirect is then done to a page that checks to see if the cookie exists. If it does, another redirect is done back to the home page. If not, an error page is displayed.

At the top of all my other pages is another PHP routine that grabs the session ID from the cookie and checks to see if it is already in the database. If it is not, then a redirection is done to the home page (Hey! I've got my own way to force people to enter through the front door!) If the session ID is known, then the current time is updated, as well as the name of the page being sent, and the page continues to load.

When a user clicks on a link to a video file on my video index page, the link goes to another PHP file that does the work. Passed along to the video viewing page is the video file number, not the video file name. The information regarding the video file is contained in a database table. This give me some flexibility and ease of coding, and also hides the video file name.

When the video viewing page runs, it first checks to see if the session ID is known, redirecting to the home page if not. If it is known, then it updates the users record with the current time and the name of the file requested. It then gets the information for the requested file from the database, checks to see if the file exists, and if so, sends a few headers followed by the file data itself. The trick here is that it uses PHP to read in the file, and send the data to the waiting browser.

Now for the interesting part. When IE6 sees that it is a WMV file arriving, it stops the transfer and passes the URL to Windows Media Player. Windows Media Player then does an HTTP GET for that URL, which is the video viewing file and video number, not the video file itself. The video viewing file does the same checks again, but because it does not care about the referrer information, the file will again be sent using PHP file read and send functions.

If someone bookmarks the URL that points directly to the video viewing file, along with the video number, when they eventually come back to it, the video viewing file will not find them in the database, and will redirect them to the home page. If a web site includes a link directly to the same URL, anyone clicking on that link will not be known either, and will be redirected to the home page.

A cron job runs another PHP file that cleans up the user tracking table. It looks for records that are older than 30 minutes (the aging time can be changed) and deletes them.

The Details (or, great. So, just how do I do this magic anyway?)

First up, the tables needed to do this. Two of them, in fact.

The first table stores the information about your video files. I've called this table "gallery_video" on my system.

gallery_video
An explanation of each field:

VideoID: The ID number of each video.

VideoActive: If you want to remove a video from the server, but leave its information in the table, this can be set to "no". Set to "yes" otherwise.

VideoTitle: User friendly name for the video.

VideoDate: User friendly date for the video. Useful if the file date is not the date you wish users to see.

VideoFile: The actual video file name, without the extension.

VideoTime: User friendly video length in min:sec (00:00)

VideoSize: User friendly video size (I use 00.0mb)

VideoViews: Number of times video has been viewed. (A nice byproduct of this whole thing.)

The second table stores the information about each visitor. I've called this table "user_session"

user_session
An explanation of each field:

SessionID: A unique alphanumeric id code for each user.

UserIP: The users IP address.

UserHost: The users host name. Not used in this example, but could be useful.

UserStart: The date and time the user first entered the site.

UserCurrent: The date and time the user last requested a page or file.

UserPage: The page or file the user last requested.

Now for the folder and file layout. This layout is for this example. If you wish to use a different layout, by all means do so. Just remember to adjust the paths that are referenced within the files themselves.

File/Folder layout
WMV video files are stored in the /video folder. Thumbnails for the video files are stored in the /thumbs folder. In this example, they must be JPG files and have the same basename as the WMV file.

Continued next message...

(Edit: updated link to other thread.)

Out of curiousity, did our hotlinking in cpanel help with you prevent wmv files at all?  If you login to Cpanel and click on the hotlinking icon, you will see an area where you can specify the extensions, e.g. jpg,jpeg,gif,png,bmp.  I don't have any wmv files to test it out, but was curious if you tried this as one of your options just for future reference.

Your post made me realize it might be a good idea for me to put hotlinking protection on a small collection of videos I have on my site.  So I used cpanel to prevent hotlinking to .mov, .wmv, .mpeg, etc.  It seems to be working fine as far as I know - I can still view the videos, anyway.  I'd appreciate some of you checking to be sure you have no trouble viewing the Quicktime videos and Windows Media Videos.

Thanks.

Jim - I went to your page yesterday and was unable to get any of your videos to play.  I don't know why, but all I got was a blank Windows Media screen.

You could also use something like flash to prevent hotlinking.  That way the video would stream without any problem.

Colleen,

I have to believe that it is something with your computer that is preventing you from viewing the videos on my site. I say that because you are the only person who has mentioned this in the last six months or so.

Now, that doesn't mean that I don't want to figure out what the problem is, because I'm sure someone else will come along some day with the same problem.

You mentioned that you just got a blank Windows Media Player screen. Did it show any other information? Did it show the title of the clip? What version of WMP is it? What browser are you using?

...jim

So I take it there is no simple way to just block .WMV files with hot-linking protection???