private variables, or any way to protect variables

Matth_S

Hello,

I'm coding a page which is to be included in php pages from other websites. So I would like to protect my variables so that they can't be accessed from other pages.

Do you know if it's possible to make the variable protected so that they can't be accessed from any pages but the page in which they are declared ?

Thanks

Shrike

In PHP 4 you could simulate the private-ness by wrapping variables in functions. I'm pretty sure that will lead to headaches though. PHP 5 has private class variables.

thorpe

php pages included from servers outside of the one they are stored on are parsed before they are included so there shouldnt be a problem anyway.

Matth_S

thanks for your answers !

I'm relieved to not have to manage this security problem 🙂

Shrike

Files are parsed before they are included on a local file system too. I think the issue is to do with either data hiding or worries about overwriting variables.

Matth_S

Shrike wrote:
Files are parsed before they are included on a local file system too. I think the issue is to do with either data hiding or worries about overwriting variables.

now I don't understand 🙁

On local files system, when a file is included, it's possible to access the variables in the parent file, even if the included file is parsed before. So, will it be possible to access my variables on another server if I don't protect them ?

Shrike

If on the other server they use require() to load your file then your code will be executed on the remote server. However if they use file_get_contents() or something simillar then your code will be executed on your server and the output will be available to the remote server. Using require() on a remote file requires the fopen_wrappers directive to be set.

A quick check of the manual shows that the directive is allow_url_fopen.

In answer to your question - if they include() or require() your file yes any functions, classes and variables defined there will be available to the remote server.

Matth_S

Ok, thanks for the explaination 🙂
so actually that's the problem, on the other server they use a require() or an include() to load my file. Unless I haven't correctly understood, it means they can get the values of the variables after including the file...that's what I would like to prevent.

My server is still in php 4, so let's start the headache 🙁