How to provide embeded dynamic content to visitors?

MattG

Hi,

I wasn't sure where to put this but if the mods think somewhere else is better please move the topic.

I was wondering if anyone could suggest the best way to provide a feature for people to embed dynamic content from my database on their own websites?

I was thinking the best way would be giving them code that links to a specialised php script on my site via an iframe but IIRC people aren't too keen on iframes so can anyone suggest a better way to do it?

Thanks in advance

dougal85

you could get them to write a script that you then just do a file_get_content of it on their server and display the output.

Whatever you do is going to require lots of trust or security measures.

MattG

dougal85 wrote:
you could get them to write a script that you then just do a file_get_content of it on their server and display the output.

Whatever you do is going to require lots of trust or security measures.

If I use the iframe method, there wouldn't be much more security risk than if they were just looking at a page on my site would there?

The iframe would link to something like http://www.address.com/embedcontent.php?id=42 and I would put in a measure to make sure that it only accepted a numerical id and anything else would result in a die() command.

Or am I missing the bigger picture?

Shrike

Have you considered an RSS feed?

dougal85

I wasn't suggesting an iframe.

You just need to be wary of whats data comes from them, that's all. As you have no control over it apart from a filtering process. This is like all data but including content from a page or showing at as an iframe or whatever makes it harder to manage than a simple form input.

MattG

Shrike wrote:
Have you considered an RSS feed?

It's a possibility but I wanted to have more control over the formatting of the data HTML-wise.

dougal85 wrote:
I wasn't suggesting an iframe.

You just need to be wary of whats data comes from them, that's all. As you have no control over it apart from a filtering process. This is like all data but including content from a page or showing at as an iframe or whatever makes it harder to manage than a simple form input.

How I was thinking of doing it was having a php script on my server that they feed an ID number to. The php script on my server would do all the work and it would be accessed via an iframe so for instance the third party would put this code into their page

<iframe src="http://www.domainname.com/embedcontent/165/" width="250" height="640"></iframe>

I'd use htaccess to rewrite the url so that embedcontent/165/ would be embedcontent.php?id=165 with 165 being the id number of the row in the database and within that php file I'd limit what could be used as the id with something like...

if(is_numeric($_GET[id])) {
 // do database work
} else die('You did not provide an id number');

would that be secure and prevent mysql injection?

dougal85

Oh right, I think I miss understood. I was imagining you were getting data from them, not the other way around. Oops. That way would work.

Rather them using an iframe, then would so something like;

<div id="output-box">
<?php
echo file_get_contents("http://www.domainname.com/embedcontent/165/");
?>
</div>

That would then allow them to style the received data with CSS or something. With your idea or mine there are still big limitations. Since they will then have to trust your data. An iframe would enforce a bit more security but it wouldn't allow them to change the style on it (easily). However, I think you might want to control the formatting, so an iframe will do the job...

The best way by far would be a Soap or REST web service. However, that requires a bit more work than your proposed way.

MattG

dougal85 wrote:
Oh right, I think I miss understood. That would work.

The best was would be a Soap or REST web service. However, that requires a bit more work than your proposed way.

Thanks for your help dougal. I think I'll do it with the iframe then, seems like the easiest way to implement it

dougal85

You might want to re-read my post. I added a bit more before realising you'd replied.