...

View Full Version : Include/require order



Ge64
01-07-2007, 08:16 AM
I have a file called index.php:



require 'http://www.ge64.nl/dbzoek/config.php';
require 'http://www.ge64.nl/dbzoek/functions.php';
require 'http://www.ge64.nl/dbzoek/dbzoek.php' . passgetvars($_GET);


But it returns an error. This is because the function passgetvars is defined in functions.php. Is there any way to make functions.php included first before it continues the script, that way the 3rd line would work.

_Aerospace_Eng_
01-07-2007, 08:34 AM
Hmm seems like allow_url_fopen might be turned off meaning you can't use http urls. Try this

require 'config.php';
require 'functions.php';
require 'dbzoek.php' . passgetvars($_GET);
From the manual on require

Windows versions of PHP prior to PHP 4.3.0 do not support accessing remote files via this function, even if allow_url_fopen is enabled.

Ge64
01-07-2007, 09:04 AM
Hmm seems like allow_url_fopen might be turned off meaning you can't use http urls. Try this

require 'config.php';
require 'functions.php';
require 'dbzoek.php' . passgetvars($_GET);
From the manual on require

Well the script is running on a different server, so the code you posted would never work. Also, it is running on PHP4.1 Linux, actually I did read the notice. The included pages work except they arae all included at the same time, therefor the 3rd one returns an error (the 2nd one hasn't finished yet when php tries to include the 3rd one)

Ge64
01-07-2007, 09:07 AM
Wow look what I found:


Something not previously stated here - but found elsewhere - is that if a file is included using a URL and it has a '.php' extension - the file is parsed by php - not just included as it would be if it were linked to locally.

This means the functions and (more importantly) classes included will NOT work.

for example:

include "http://MyServer.com/MyInclude.php";

would not give you access to any classes or functions within the MyInclude.php file.

to get access to the functions or classes you need to include the file with a different extension - such as '.inc' This way the php interpreter will not 'get in the way' and the text will be included normally. From the manual on include/comments

i'll try that

Edit: It works! I wonder why it doesnt work when you use .php though...

_Aerospace_Eng_
01-07-2007, 03:50 PM
Mainly for security reasons so a user can't just execute the php from a remote host.

CFMaBiSmAd
01-07-2007, 04:23 PM
By having remote code/configuration files that can be included, they can also be viewed. This creates a great security risk for your server. Here are the first few lines of your admin.inc code -

<?php

if (md5($_GET['adminpass']) == $md5pass) {
if (isset($_GET['del'])) { Someone will find a security hole in your code or will find your database username and password. I recommend you don't write code that works in this way.



EZ Archive Ads Plugin for vBulletin Copyright 2006 Computer Help Forum