Preventing Hijacking with SRC and QTSRC

Other plugins can hijack the .mov file type, preventing people from viewing QuickTime movies, even when QuickTime is installed.

The Old Solution

In the book, I recommend correcting this by setting the SRC parameter to a QuickTime Image File (.qti or .qtif file extension, MIME type "image/x-quicktime"), then passing the actual movie url in the QTSRC parameter.

The HTML looks like this:
<EMBED QTSRC="Actual.mov" HEIGHT="yyy" WIDTH="xxx"
      SRC="UNeedQT4.qtif" TYPE="image/x-quicktime"
      PLUGINSPAGE="http://www.apple.com/quicktime/download/" >

This does prevent hijacking, because other plugins don't take over .qtif files. People with QuickTime 4 or later see the movie, not the image.

BUT, your Web server must have the .qti and .qtif file extensions mapped to the MIME type "image/x-quicktime" for this to work.

AND, unfortunately, people with earler versions of QuickTime see a broken plugin icon instead of the QTIF image. QuickTime 3 (and 2.5) can display QTIF files, but prior to QuickTime 4 the plugin didn't advertise the MIME type. If you have QuickTime 3, your browser is configured to use PictureViewer for .qtif files, not the QuickTime plugin. The EMBED tag is not compatible with helper apps, only with plugins, so the .qtif image does not display.

Again, this technique does prevent hijacking, and with QuickTime 4 or later all is well, but people with earlier versions of QuickTime see a broken plugin icon, not a nice image telling them where to get the latest version of QuickTime.

The New Solution

There is an alternate approach you can take that works with older versions of QuickTime. Instead of passing a QTIF file in the SRC parameter, pass a MacPaint image (file extension .pntg, MIME type "image/x-macpaing"). Don't laugh, this actually works.

The HTML looks like this:
<EMBED QTSRC="Actual.mov" HEIGHT="yyy" WIDTH="xxx"
      SRC="UNeedQT4.pntg" TYPE="image/x-macpaint"
      PLUGINSPAGE="http://www.apple.com/quicktime/download/" >

This approach also prevents hijacking, and people with QuickTime 3 see an image telling them they need to upgrade, rather than a broken plugin icon.

Important: Your Web server MUST be configured to associate the .pntg file extension with the MIME type "image/x-macpaint" or it won't work.

Yes, it works on Windows. No, the viewer doesn't need MacPaint (and neither do you).

Here are three images you can use: 640x480, 320x240, 180x120

Use the largest image that fits inside the height and width you allocate for your movie.

All the images are 5 kbytes in size.

Bear in mind that only people with QuickTime 3 will see the image. People with QuickTime 4 or later will never see it -- they see the movie instead.

Note: If you want to make your own image, start with a program such as Photoshop. The image size must be exactly 576 x 720 pixels (W x H). It must be black and white (not grayscale). The part of the image you want people to see must be centered. If your desired image size is 180 x 120 pixels, for example, put an image that size in the center of a 576 x 720 field. Save it as a bitmap image. Convert it to MacPaint format using PictureViewer (included with QuickTime Pro).