Error passing variables into included file

craig34

I've been passing variables, such as page_title, into included header files by defining them before the include. However, one thing that was constant in this process was the fact that the include path was always relative. Example: include("../header.php").

Now, due to restrictions that I've run into while working with mod_rewrite, it appears that I have to use absolute include paths (otherwise the include will not work at all), such as include("http://www.mysite.com/header.php").

This would be fine, if it wasn't for the fact that the variables are no longer passing into this file for some reason. Other than the fact that the path is absolute rather than relative, I have no idea why, but I was hoping that someone might shed some light on this.

craig34

If it's applicable at all, I have used mod_rewrite to rewrite all files (except for any images or CSS files) to one PHP file. This PHP file then checks if the real file exists and if it does, it includes the actual file. If it doesn't exist then the file checks for database content, and if all else fails it displays a 404 Not Found File. The basics of the code are below:


// Security efforts that prevent query strings of more than 100 characters
if (strlen($REQUEST_URI) > 100) { header("HTTP/1.1 404 Not Found"); exit; }

//1. check to see if a "real" file exists and include it if it does
if (file_exists($DOCUMENT_ROOT.$REQUEST_URI) && ($SCRIPT_FILENAME != $DOCUMENT_ROOT.$REQUEST_URI) && ($REQUEST_URI != "/")) {
	$temp_url = "$DOCUMENT_ROOT" . "$REQUEST_URI";
	$url_length = strlen($temp_url);
	if (substr($temp_url, -1) == "/") {
		$temp_url .= "index.php";
	} else {
		// do nothing
	}

include($temp_url);
exit();
}

//2. if not, go ahead and check for dynamic content.
$url = strip_tags($REQUEST_URI);
$url_array = explode("/",$url);
array_shift($url_array);

// This includes a file that has the main page information
if ($url_array[0] == '') {
	include("index.php");
	exit();
}

// Look if anything in the Database matches the request 
if (check_db($url_array)) {
	exit();
} else { //3. nothing in DB either  Error 404!
	header("HTTP/1.1 404 Not Found"); 
	exit();
}

edwardsbc

Please read the manual for [man]include[/man]. It states quite clearly that for URL include targets, variables must be passed via a URL/GET because the include is processed as it is retreived.

<?php
/* This example assumes that [url]www.example.com[/url] is configured to parse .php *
 * files and not .txt files. Also, 'Works' here means that the variables *
 * $foo and $bar are available within the included file.                 */
// Won't work; file.txt wasn't handled by [url]www.example.com[/url] as PHP
include 'http://www.example.com/file.txt?foo=1&bar=2';
// Won't work; looks for a file named 'file.php?foo=1&bar=2' on the
// local filesystem.
include 'file.php?foo=1&bar=2';
// Works.
include 'http://www.example.com/file.php?foo=1&bar=2';
$foo = 1;
$bar = 2;
include 'file.txt';  // Works.
include 'file.php';  // Works.
?>

DeltaRho2K

You know, I just put:

extract($_GET);

at the top of my included files, and it retrieves the variables fine...
even with relative inclusion...

Now, I will say, I use the .inc extension for my includes...

craig34

I've never had any problems with using relative inclusion, it's absolute that's giving me trouble now. I'll try your idea though. I don't use .inc because they are not secure on my server. If you punch in for instance, header.inc (under my old setup) you could download that file and view all of my passwords.

Actually, that brings up a good question. How do you ensure that information is secure? Do you keep it in the .inc files?

edwardsbc

Keep passwords and other information you don't want accidentally disclosed outside of the web tree if at all possible. I simply put them in a include file in the include_path (php.ini) location, which is normally outside of the web server's document tree.

craig34

The file can still be included from within my PHP documents that are in my web tree? How would I reference these includes? With an absolute path?

DeltaRho2K

I do the same...

edwardsbc

Yes, either use an absolute file path (file system path obviously), or put it in the include directory and use no path at all (php will search for the file in the include directory automatically).

I use something like this, where the web tree starts at /var/www/html...

include('/var/www/phpinc/dbcredentials.php');

or if include_path in php.ini includes /var/www/phpinc then just:

include('dbcredentials.php');

If for some reason apache quits sending php files to php for processing, and instead just returns the php code my passwords are still safe. Apache cannot/will not serve up pages outside the 'web root' (/var/www/html' im my case).

craig34

Originally posted by edwardsbc

<?php
/* This example assumes that [url]www.example.com[/url] is configured to parse .php *
 * files and not .txt files. Also, 'Works' here means that the variables *
 * $foo and $bar are available within the included file.                 */
// Won't work; file.txt wasn't handled by [url]www.example.com[/url] as PHP
include 'http://www.example.com/file.txt?foo=1&bar=2';
// Won't work; looks for a file named 'file.php?foo=1&bar=2' on the
// local filesystem.
include 'file.php?foo=1&bar=2';
// Works.
include 'http://www.example.com/file.php?foo=1&bar=2';
$foo = 1;
$bar = 2;
include 'file.txt';  // Works.
include 'file.php';  // Works.
?>

[/B]

Say, for instance, that I have a file called index.php that defines the variable $page_title as 'The Main Page'. Then I include header.php in one of the formats outlined by you above, and it takes the variable fine. At some point in header.php however, say that variable $page_title is changed to 'The Second Page'. When header.php is done processing and it goes back to finish processing index.php, what will $page_title be?

Also, as I was re-reading your message another question occured to me. From the example that you posted, it seems that for an absolute inclusion, the variables must be defined in the path and for a relative inclusion, the variables can be defined in the lines of code preceding the inclusion. Am I right?

edwardsbc

I think I need to make clear that [man]include()[/man] is doing TWO very different things depending on the arguement provided. If the argument is a 'file' reference, the CONTENTS of that file are included verbatim at that point in the current script.

If the arguement is a 'protocol' reference, the RESULT of the protocol fetch is included at that point of the script.

Here's my dumb example.

File getme.php:

if(isset($var1) {$result=1;}
if($result>0) {echo '<p>A result</p>';}

A 'file' reference, test1.php

$var1=0;
include('getme.php');

This results in the following php code:

$var1=0;
if(isset($var1) {$result=1;}
if($result>0) {echo '<p>A result</p>';}

Now a protocol reference, test2.php:

$var1=0;
include('http://www.myweb.com/getme.php');

Which results in this php code:

$var1=0;
#and nothing else!

But with $var1 passed, test3.php:

$var1=0;
include('http://www.myweb.com/getme.php?var1='.$var1);

results in this php code:

$var1=0;
<p>A result</p>

Yes, I know the last is bad code, but that is what happens.

As for your questions, I think it should be clear now that 'protocol' inclusions have no effect upon, and cannot change (directly) variables in the calling script unless the included file actually PRODUCES code that changes the variables. It is a subtle but important difference. Imagine if my IF statment were like so:

if($result>0) { echo '$var1=10;';}

Now in the last example, test3.php the result would be:

$var1=0;
$var1=10;

craig34

Everybody thanks for all of your help. I've changed my original method and basically have my solution. Instead of re-writing every file that comes in, and checking for existing static content and then dynamic content, I have changed it to rewrite only URLs that begin with /test/.../.../../. This will still allow me to use relative inclusion and passing variables is no longer an issue.

The code is below:

ErrorDocument 404 [url]http://www.my_site.com/[/url]
DirectoryIndex index.php index.html index.shtml index.htm default.html default.htm default.shtml

RewriteEngine On
RewriteRule ^test/(.*)/(.*)/(.*)/(.*) /item.php?var1=$var1&var2=$var2&var3=$var3&var4=$var4

Although I have to use /test/ on every URL that I wish this to work for, that is worth it at the moment. I'm only now trying to decide between .htacess and httpd.conf. Any ideas?