A tale of two servers

Skawn

Could anyone explain what happens here? I dont have the resources to test myself...

2 servers, both with php installed.

Server A has a .php file on it:
URL for the file is http://www.serverA.com/hello.php

Server B has a .php file that has a line in it:
<?php include('http://www.serverA.com/hello.php'); ?>

Would the contents of the file hello.php be correctly displayed? (I assume yes)

Which of the two servers will actually process scripts in hello.php? the server on which it is hosted or the one that had the file as an include? (I assume it'll be server B in the example above?)

Assuming I'm right and it's server B - is there any way of getting server A to just send the result of parsing hello.php?

Hope I explained that so it made sense!

laserlight

Would the contents of the file hello.php be correctly displayed?

Yes, assuming Server B has the fopen wrapper enabled. Of course, "correctly" is subjective.

Which of the two servers will actually process scripts in hello.php? the server on which it is hosted or the one that had the file as an include?

Server A would process the script, the result of which will be sent to Server B.

MarkR

This will not do what you want.

Both servers will in fact parse the file as PHP - if serverA's hello.php outputs <?php , then the code it outputs will be interpreted by PHP on serverB as well.

This is never, ever, ever, ever what you want. Just don't do it. Ever. At all.

One evidence that this is always undesirable behaviour, is that including URLs has now been disabled by default in PHP 5.2.0 and requires enabling a special flag to turn it on (not that you would ever want to).

The reasons it's bad are:
1. Self-writing code is possibly the most obfuscated programming technique around (see eval)
2. Almost everyone who uses include(some url) fails to understand the security implications of it - if serverA is compromised, SO IS SERVERB - the developer of the application of ServerA gets the ability to run arbitrary code on B.

Mark

Skawn

Thanks for the replies both.

This is kinda interesting although MarkR - your reply is somewhat concerning!

The output from hello.php on server A is just HTML. Server A is an externally hosted application with it's own database etc.

Server B is an internally hosted website which I'd like to be able to use content from server A on. While I have access to an API which I can use to achieve this, it'd require a lot more work setting up than if I could just use include() to get the relevent bits of the site hosted externally.

Does that still sound like madness?

MarkR

There are other solutions rather than using include(). For instance, if you don't need to execute PHP from the other server (which you should not do, unless you need your head testing 🙂 ), then you can use file_get_contents instead and echo() that.

That would have the effect of outputting the HTML from the other server, without parsing it for PHP code, which is probably more like what you want.

Other options include returning a structured response from the other server (XML, serialized form from PHP, JSON, etc) and then processing it to incorporate it into the design of your internal site.

It's also possible to use "screen scraping" - to parse the HTML from the other site and extract elements programmatically. If you have create the other application yourself, and have direct control over it (i.e. designers can't simply change the design without your say-so), this may be an option.

Personally I'd lean towards a server-server structured response, e.g. PHP serialised form (which is the simplest if both ends run PHP).

Mark

Skawn

The php that I'm including from the external server needs to be executed - it's all dynamic content from the database on that server and I don't have direct access to the database.

Sounds like the API is going to be the best way forward...

MarkR

What I mean is, if you use include(), then the PHP code will be executed TWICE. This is never what you want.

The PHP on serverA will still be executed with (e.g.) file_get_contents, it's just that it won't be run additionally on ServerB.

Mark