PHP Non-Local Include Problem

Why aren''t you including it using a local address string?

include("../include.php");

... or ...

include("./battle/battle.php");

quote:

---

Original post by Ketay
I have a question about php includes. On php.net it says that you can do includes like:

include("http://www.site.com/directory/file.php");

---

This should work with later versions of PHP, but it won''t do what you want it to do. It will connect to the webserver at www.site.com, which will parse file.php. The output of file.php will be included into your script. Not what you want. Also it''s a bit of a security hole, so most servers have it disabled.

[teamonkey]

Could someone explain, why including files would reduce security??
(If this is what Teamonkey meant)

--
You''re Welcome,
Rick Wong
- sitting in his chair doing the most time-consuming thing..

quote:

---

Original post by Pipo DeClown
Could someone explain, why including files would reduce security??
(If this is what Teamonkey meant)

---

If you had a file called password.php on your site and allowed it to be included remotely via HTTP, anybody could include it from anywhere and gain access to your code. A file included that way, as teamonkey said, should normally arrive already interpreted (i.e., the server to which you connect runs the script and only sends you the output without the code).

Since the file you want to include is on the same server, your best bet is to use the directory path.


[edited by - DaTroof on January 11, 2004 2:19:22 PM]

But if you use php tags to set the passwords:

<?php
$password = "bla";
?>

Then the page will be empty won''t it be? How would this be unsafe then??

--
You''re Welcome,
Rick Wong
- sitting in his chair doing the most time-consuming thing..

Yes, but then you can''t access it externally

quote:

---

Original post by Pipo DeClown
Could someone explain, why including files would reduce security??
(If this is what Teamonkey meant)

---

Including files is good practice. Including files from remote sources is not. In short, it allows you to run arbitrary code of which you can''t guarantee the content. For example:

http://www.site-a.com/index.php

    // This is safe because a_file.php is in our user space.
    // We can guarantee the contents of the file
    include("a_file.php") 

    // This is unsafe because someone might change the contents
    // of the file... see below
    include("http://www.site-b.com/includedfile.php");

    // do stuff...
?>
 

http://www.site-b.com/includedfile.php [u]outputs[/u] the following code:

    // Ha! Y00 L00Z3RZ su>    getServerConfiguration();
    searchForExploits();
    doWhateverWeWant();
    mail10000EmailAddresses();
    forkBomb();

    function getServerConfiguration() {

...

?>
 

That code will be executed by PHP on site-a''s web server. Not good.


If you need to store your username and password in plain text, put it in a separate file like you describe, but put that file in a subfolder that is protected by a .htaccess file. You will still be allowed to include() it, but you get a forbidden message if you point your browser to it (yes, it would probably just be blank anyway but better to be safe than sorry).

[teamonkey]