require/include problems

Pureblood

Hi,

although I don't consider myself a php-newbie, I thought this questions is quite newbish:

I'm trynig to require a php-file in another php-file, but the oen that is included with the "require"-statement is stored on a different server. Well, it just doesnt seem to work: the functions provided in the required files are just not available, I can neither access anything of the file with "require" nor with "include"... I'm lost :S.
Is there a way to make that work? Do I need to link through to the other file with each function call? Please don't tell me to store both files on the same server... there is a reason I have to keep it this way.

regards,
~Pureblood~

laserlight

I dont have the experience of working with multiple servers, but chances are you may be able to configure the webserver such that both servers appear under a single filesystem.

Alternatively you can treat the other server as a database (perhaps a text file database), so you retrieve the PHP code unparsed and then apply [man]eval/man.

MarkR

Make a copy of the file you need, on the machine you need it on.

Require or including PHP files by a URL is NOT a good idea, and it will probably NOT do what you want, and it smells bad.

Basically, when you request a PHP file by HTTP, the server won't serve the file, it will execute it instead. Therefore, if you use require(some url), the PHP script will be executed on the remote server, and its output WILL BE TREATED AS ANOTHER PHP SCRIPT.

This is unbelievably dangerous as it gives the owner of the other site the ability to run arbritary code on your server, moreover, it smells of code-writing code, which is usually a really bad anti-pattern.

Mark

laserlight

Therefore, if you use require(some url), the PHP script will be executed on the remote server, and its output WILL BE TREATED AS ANOTHER PHP SCRIPT.

No, it wouldnt, unless eval() was used. It is precisely that because the PHP scripts will be executed serverside, and then passed on to the recepient server.

This is unbelievably dangerous as it gives the owner of the other site the ability to run arbritary code on your server

No, unless eval() is used, there is no code execution. It is as dangerous as having incoming variables (which can be dangerous under some circumstances e.g. clientside cross scripting, but not in the running of arbitrary code serverside).

Pureblood

well, thank you for your input so far, but I think eval() will not help me. The module I want to include contains a few functions and requests some variables from a database, and that is all I want to access. So, the first thing I need is to get some of the variables, and then a way to execute one of these functions (which will most likely not be too hard tho, I think I know how to do that part). I'm currently at work, so I cant access the files to test anything right now, but will do that this evening.

laserlight

well, thank you for your input so far, but I think eval() will not help me. The module I want to include contains a few functions and requests some variables from a database, and that is all I want to access.

Do you have legitimate access to the other server? If you dont, forget about it. The eval() method I suggested requires modification of the scripts on the external server such that they are no longer parsed as scripts. Merging the two servers would also then be out of the question.

Pureblood

yes of course I do... 🙂

laserlight

In that case, you have to decide which path you want to take. I would go with attempting some sort of server filesystem merger, but unfortunately you will need someone with expertise in that area to tell you if it is possible, and if so, how to go about it.

The eval() way is really just an ugly hack. For example, you could have:

//http://www.example.com/hello.php
function printHelloWorld() {
	echo "Hello world!";
}

on the external server. Note that there are no PHP start/end tags here, so you could just as well use normal text files.

Then on your main server:

eval(file_get_contents("http://www.example.com/hello.php"));
printHelloWorld();

Roger_Ramjet

Seems to be a lot of confusion here about what hapens when you include via a url

from the manual

If "URL fopen wrappers" are enabled in PHP (which they are in the default configuration), you can specify the file to be included using a URL (via HTTP or other supported wrapper - see Appendix M for a list of protocols) instead of a local pathname. If the target server interprets the target file as PHP code, variables may be passed to the included file using a URL request string as used with HTTP GET. This is not strictly speaking the same thing as including the file and having it inherit the parent file's variable scope; the script is actually being run on the remote server and the result is then being included into the local script.

Warning

Windows versions of PHP prior to PHP 4.3.0 do not support accessing remote files via this function, even if allow_url_fopen is enabled.

What matters here is whether the remote server is configured to parse php files. If it is then, since you are defaulting to the http protocol unless otherwise specified, the remote server will execute the script. Only reason I can think of to have the file on a remote server is so that it can be execeuted there so I'm sure this applies to your case.

You could grab it another way with ftp or file handling functions and include from your local tmp folder of you want the raw text. Remote server has got to allow you to access the file so you'll need login details for the file system.

laserlight

Only reason I can think of to have the file on a remote server is so that it can be execeuted there so I'm sure this applies to your case.

Apparently not, since Pureblood wants to use functions contained within those scripts on the remote server. Unless those PHP scripts are left unparsed when requested by the local server (e.g. using the eval() hack that I described), that just isnt possible.

You could grab it another way with ftp or file handling functions and include from your local tmp folder of you want the raw text. Remote server has got to allow you to access the file so you'll need login details for the file system.

Yeah, FTP is an alternative to (or perhaps a way of) trying to merge filesystems across servers.

MarkR

laserlight wrote:
No, unless eval() is used, there is no code execution.

Yes there is. require will execute the contents of the incoming file (assuming it contains <?php tags). This means that arbritary code will be able to be injected (in principle) by the owner of the other server.

If the other server is also configured to execute PHP files, the file will be executed twice by PHP. Once on the remote server, then the output of that will be treated as a PHP script and executed locally. It is possible (but highly undesirable) to use this to make code-writing-code. I consider this an antipattern.

I still don't understand why the OP can't simply copy the PHP file to the server where it needs to be executed.

Mark

laserlight

Yes there is. require will execute the contents of the incoming file (assuming it contains <?php tags). This means that arbritary code will be able to be injected (in principle) by the owner of the other server.

That's true, but it isnt what I had in mind since I was assuming that the other server was maintained by Pureblood as well, hence the PHP code on the other server (which should have PHP support) would have been written in a normal fashion, rather than intended to output another script. The way Pureblood wants to do it means that there simply is no way to prevent malicious code injection if the remote server falls into a cracker's hands - effectively the remote server becomes an extension of the local server.

I still don't understand why the OP can't simply copy the PHP file to the server where it needs to be executed.

Agreed.