Hello everyone,

Glad to be part of the PHP world, and seeing all of its powerful capabilities.

I have researched and somewhat understand the function of require(), but my question concerns if there are any security or bandwidth issues arising when using multiple require in the same page? I chose this instead of include() as I understand it stops the script if the referring file was missing. These external *.PHP files only include HTML data.

Shared server with PHP 4.x and creating about 200 product catalog pages each with file extension *.PHP These pages are primarily HTML with the following single line PHP on top. Each single line scripting block enclosed with the PHP opening and closing syntax.

php require("directory/filename.php");

Another inserted in the middle of the page:
require("directory/filename2.php");

And a third placed at the bottom of the page for the footer:
require("directory/filename3.php ");

These external files represent sections that if changed (ie: a navigation menu struction), would prevent making the change on 200 individual catalog pages.

I have read about on several sites about turning "register_globals = off" in a php.ini, but the only variable I seem to have is the external php file being called.

Thanks in advance for your assistance.

    Is this content that you have been given permission to scrape?

      Who said anything about scraping? did i miss something?

      I think the overhead caused by a include/require is not something you are going to need to worry about.

      Why not create a test for yourself?? use a loop and include 1000 files and time it, see how long it takes. (could be the same file, assuming you don't use include or require _once

        adante wrote:

        if there are any security or bandwidth issues arising when using multiple require in the same page?

        I don't know about any "security" concerns if you're not using user-supplied data (e.g. a $_GET['page'] variable) in the file path. As for bandwidth, you aren't using any bandwidth at all if the files reside on the server itself (and if they didn't, e.g. you were including HTML content from an external site, you certainly would not want to use include/require()!).

        adante wrote:

        I have read about on several sites about turning "register_globals = off" in a php.ini, but the only variable I seem to have is the external php file being called.

        Yes, register_globals should definitely be disabled. I don't understand what you mean by "the only variable I seem to have is the external php file being called."

          He says:
          "external *.PHP files only include HTML data"

          I took that to mean he is pulling files off another website via:
          require("http://www.somesite.com/somefile.php");

          which you can certainly do. Whether that website is his or not, that's scraping. I did not want to answer this question if it is being used for the wrong reason like so:

          <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
          <html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml">
          <body>
          <?php
          require("http://www.ebay.com");
          require("http://www.playboy.com");
          ?>
          </body>
          </html>

          Common sense says that in the case where files exist on the same server, of course security shouldn't be a concern. Duh! We wouldn't be able to build applications modularly and reuse code. Every PHP CMS, blog, forum, etc would show poor performance. require and include are essential to building modular applications.

          Thats like saying:

          <html>
          <body>
          <?php
          require_once("header.php");
          echo "hello, world";
          require_once("footer.php");
          ?>
          </body>
          </html>

          is doomed to fail!

            Sorry about the misunderstanding about "external" files. I was using that word to represent the .PHP files being pulled in from our catalog subdirectory we created which only contains the .PHP files being called in.

            Yes, dougal85 is correct, these are all files within our directory structure. They are not remote files (not coming from any other website). In reference to bradgrafelman, you are correct, there is no user supplied data, just the filename being referenced.

            kkobashi brings up another good point by illustrating "require_once". Sounds like this is another option to explore when writing PHP scripts. Per my understanding, although our PHP script is only this single command, it sounds like "require_once" would be preferred over using "require" in case we enter the same filename twice on our page.

            Is there another consideration when deciding between require() and require_once() ?

              Edit - and that teaches me to read the post fully before I reply. Mod, please remove? :o

                Lets take an example. Suppose we have a page that has two voting polls on it. You break up your application to create a poll class and store its definition in poll.php.

                poll.php

                class poll {
                function poll () {
                }

                function Show($pollId) {
                // database stuff based on pollId
                .
                .
                echo $pollHtml;
                }
                .
                .
                }

                And lets create a logo file.

                logo.php

                <div id="logo">
                <img src="logo.jpg" alt="our logo"/>
                </div>

                Now suppose these polls are to displayed on the home page. Since poll.php contains the DEFINITION of a poll class, there is no need to multi define it in our code. To prevent that, we use require_once("poll.php") instead.

                index.php

                <?php require_once("poll.php"); ?>

                <html>
                <head><title>Poll Page</title</head>
                <body>
                <div id="page">
                <div id="header">
                <?php require("logo.php");
                <?php require_once("header.php");
                </div>
                <div id="president-poll">
                <?php
                $poll = new Poll();
                $poll->Show(1);
                ?>
                </div>
                <div id="mayor-poll">
                <?php
                $poll = new Poll();
                $poll->Show(2);
                ?>
                </div>
                <div id="footer">
                <?php require_once("footer.php");
                <?php require("logo.php");
                </div>
                </div>
                </body>
                </html>

                In the above, suppose we wanted to show our logo on both the header and footer sections. Notice that we use require and not require_once because we want to use logo.php multiple times.

                if you used require_once("logo.php") in both the header and footer, the second require_once won't show the logo in the footer.

                I hope this gives you an idea of both.

                  kkobashi wrote:

                  Since poll.php contains the DEFINITION of a poll class, there is no need to multi define it in our code. To prevent that, we use require_once("poll.php") instead.

                  In fact, you can't define a class twice. So if you used require/include in this instance you would get an error.

                  andante, You may want to consider adding most of your requires to to a file and then you just require that file in your code.

                  ie.

                  config.php

                  <?php

require('firstfile.php');
require('secondfile.php');
....
?>

                  Then in your main code, you only need to require the config.php file.

                  Of course, this wont work if the required pages output information. Ie a header/footer. But if you are working with classes or files only consisting of multiple functions it makes for a neat way to do add everything in and then you don't need to worry about it.

                  The only other consideration between require/include and require/include_once is that the _once would be SLIGHTLY slower in performance. However, I doubt you would ever be able to tell the difference.

                    My thanks to everyone for the explanations and examples. They are very well explaned and appreciated.

                      Write a Reply...