[Resolved] Need some complicated php help!!!

rudygraham

Hi I'm currently working on a php project which requires a lot of php includes for ease and security reasons! These include files are not all local though, a few of them are remote. The problem that I am having is that when the remote files try and get information based on the query string the files don't see the query. Ex. http://www.blank-example.net/fullStory.php?records=86. See the remote file won't be able to read records 86 when I use the $_GET[records]. I have tried $HTTP_GET_VAR[] and that hasn't worked either. So if anyone has any solutions to my problem, please help!!!!

devinemke

you don't even need to use GET vars

$records = 86;
include('http://www.blank-example.net/fullStory.php');

the included file will inherit the variable scope of the calling script thus it will have access to the $records variable.

Cam_Turn

And of course remember to use the $_GET vars as well:

$_GET["records"] = ($records = 86);
include("http://www.blank-example.net/fullStory.php");

Cameron Turner

rudygraham

Hey Thanks for responding you guys. However I can not just hardcode a value. You see "record" could equal anything that is in the database. You see this site that I am doing is a content managment site for our company website and a few other sites. This site allows us to update the sites easily. The thing is though, I wanted to make this as simple as possible for others to use by just giving them links to the include files - thus the reason for using remote include files! I was thinking that maybe I'm not really using the remote files properly. I'm just using include("http://broadcast.power-soft.com/includefile.php"); I tried using fopen but nothing was showing up like the include file? So maybe my new question is if anyone knows more about remote files and accessing them I would really appreciate the help. Thanks

Chris_Evans

$records = $_GET['records'];
include("http://www.blank-example.net/fullStory.php");

rudygraham

Ok I see where you guys are going with getting the record before the include file. However it was not successful. I did notice something pretty strange though. First I'll explain how these includes are set up maybe that will help in solving this problem. You see you have some random site (any site) and in this site you have several include files that come from a remote server! So within this random site you are going to have a Navigation include, a list of the stories include for each section of the nav, and within the list of the stories you are going to have another include which is the fullstory of the list of stories. Now the problem is that for some strange reason these include files (remote files) cannot read my url query string when I use $GET! I did take all you guys advice and get the record before the include and I noticed this.... If you echo record before you jump into the fullstory include and then jump into the include when you click for the fullstory of that record that echo will appear as if you actually haven't left the page of the list of records. I don't know if that made any sense! The best way to explain this all is that all these includes are all layers which just get piled onto the random site when you ask for them! So I was thinking the reason I can't use $GET within an include is because it is remote. Oh I should also make a quick mention that the list of stories include I just realized is local on the the random site - This will change to be remote! I guess that is why I could see that echo of the record when I entered the fullstory include! Stupid! I still need to know if there is a way for the remote includes to read the url query though - thanks and sorry for all the problems.

rudygraham

Oh I don't know if this is a problem or not but if you have remote files will they be able to read another url query string that isn't server side?

tsinka

Hi,

there are some points to keep in mind:

1) including remote files only works if allow_url_fopen is enabled and (PHP has not been compiled with --disable-url-fopen-wrapper)
2) on Windows server that only works as of PHP 4.3.0
3) If the remote server knows about PHP and parses PHP scripts the only way to provide variables are GET parameters. In that case the remote scripts need to know about the given GET parameters. You cannot include the source of a include file in that case if it has a PHP extension (but there are other ways to get the source).
4) include only throws a warning if the file couldn't be included so you wouldn't see any error message if the error_reporting setting excludes warnings. Use require or require_once to make sure to get a fatal error if the include file doesn't exist.

In short:
- if the remote script expects to be included locally it might not expect any GET parameters.
- if allow_url_fopen is disabled you'll not be able to include remote files at all.
- you'll not get the script source if the remote server parses PHP scripts.

Thomas

rudygraham

Ok so I check and fopen is enabled. The problem is still pointing to the remote file not being able to read the address bar query string. Now I was thinking maybe it is because this remote file is not stored locally so it wouldn't be able to read this query? Well I know that is the problem I just want to know if maybe there is a way to get the query to be transfered to the remote file so that it could read it. I was also thinking maybe a somehow storing the query string in a cookie, and then having the remote file read that cookie? Is this even possible? Please let me know of any other solutions that you guys come up with. Or maybe another solution on how to display this information on others sites without even giving them my files. The reason I don't want to give them my files is because if I update them then they would update on my side and they wouldn't have to worry about getting an updated folder. Thanks

Bunkermaster

be very careful about using cross server includes as they are known to be exploited rather heavily (there is a FreeBSD exploit allowing people to execute commands remotly on YOUR server including THEIR code for instance)

rudygraham

So I got my solution to my problem. In the end it really turned out to be something very stupid if you think about it! You see what I was trying to do with my include files was impossible. The reason being was that they had no actual connection between each other ( the other include files that is ). The other reason why my includes could not read my query string was because basically all I was doing was pulling in an include file from a remote location and that was pretty much it. The solution to it getting to read the query string was to modify my include string to this:

include("http://www.somesite.com/includes/fBody.php?records=".$_GET[records]."");

So now the include is reading the query string and in turn gets passed to the remote file. Man was I stupid!!! But now I see where you guys were kinda leading me when you guys suggested getting the query before going into the include!! So if anyone ever needs to know this that is the solution! Not really that hard - must have been one of those days because I figured out my problem in like 20min after coming back from a day of sick leave!

Chris_Evans

Well, from what I can tell, we all thought you were trying to include a script. 😉

rudygraham

I was trying to include a script! It was just that I wanted my script to be able to work in anyone's site! But the problem was that my navigation could not be seen by my content which was dependant on it because it would show content based on the category you chose on from your nav. Also the full story was dependant on the content because I need the appropriate full story to appear when I clicked on one! And each of these scripts are all remote to the site that would call these scripts!

Chris_Evans

Well from what I can tell, your trying to include the output of the script, not the script itself.

If this is the case, you should be using fopen not include. But I may have misread this. :S

rudygraham

Well your right I am displaying an output! But what is the advantage to fopen rather than include?

Chris_Evans

Well, fopen, your effectively downloading data direct from that url, whereas include is designed to include a script so you've got access to extra variables or something similar.

http://uk.php.net/include/

rudygraham

well then I would think include would be best I guess because you see the way it works (and sorry I haven't been very good at describing this) you have two sites. One is what we call broadcast. Now broadcast is a site where you go to to make your site (site 2) dynamic with content! So in broadcast you can create categories which is where all your news will be placed into. So now what site 2 has is an easy way to add dynamic content to their site! To do this all they need to do is add these include strings to their site and it will work! So if what you say about the difference between include and fopen include would be better because it would need the script to talk to the three remote pages. The three being nav, body content , and the fullstory to the content! So when you click on the a topic from the nav you create a query string which looks something like this

include "http://www.somesite.com/newsBody.php?id=".$_GET[id]."";

so now the newsBody will be able to read and be able to pull the appropriate content for that category. From their if you click on one of the list of stories, it would go to my next script which in turn will output the full story! So yes it does out put but it also talk to each script! So was I right in thinking that include would be best or do you still think that fopen is still best?

Chris_Evans

:eek: :eek: :eek: :eek: :eek:

and sorry I haven't been very good at describing this

:p true true. 🙂

Well I didn't get that... at all. But there we go. 🙂 Perhaps somebody else would care to help me understand this a bit more?

rudygraham

lol sorry... it really is hard to explain it is easier to show! Also I can't really explain it anymore because it is still in the works and I'm not really allowed to give out a whole lot of information on how this script will work! Company policy. If I could I would let you guys try it out and then you would be able to understand me better! However I can't so while it is working I am happy 🙂 and I'll leave it at that! I was wondering though if you knew anything about remote files and security on a windows server, in terms of exploiting?

Chris_Evans

🙂 This will start a heated debate.

Apache and IIS are both webservers. They both have security related problems etc... but both are always being patched.

(personal opinion is that Windows servers are always better 😃😃😃)

Anyway, when it comes down to it. PHP was designed to run on Linux, not on Windows. However I see no major problems other than a few features being left out...

Happy Christmas. 😃