Published by exdone
Posted on February 20, 2008
Allow url fopen
Many developers include files by pointing to a remote URL, even if the file is within the local system. For example:
With allow_url_fopen disabled, this method will not work. Instead, the file must be included with a local path, and there are three methods of doing this:
By using a relative path, such as ../includes/example_include.php.
By using an absolute path (also known as relative-from-root), such as /home/username/example.com/includes/example_include.php. more detailed information relating to grace of cleopatra spielautomat.
By using the PHP environment variable $_SERVER[‘DOCUMENT_ROOT’], which returns the absolute path to the web root directory. This is by far the best (and most portable) solution. The example that follows shows the environment variable in action:
 Example Include
 Processing Differences (and passing variables to an included file)
It is worth mentioning that the alternative solutions presented here will result in a difference in the way the include() function is handled. The alternative solutions all return the PHP code from the included page; however, the now-unavailable remote URL method returns the result from the included page. One result of this behavior is that you cannot pass a query string using the alternative solutions. You define the variables locally before performing the include:
To achieve the effect of this:
You must instead use this:
 Adding Flexibility
For maximum flexibility (when multiple includes are required, for example), it may be easier to create a variable:
Note: The technique works in the same way, regardless of whether you are using include() or require().
 Setting the include_path
You can also explicitly set the PHP directive, “include_path”, on the fly.
 Example exploitation
A common use of server-side includes is for creating some sort of site template. Often, a single page with a header and a footer is fed differing content by using a query string. Here is a typical example script:
If allow_url_fopen is enabled, this system can be exploited by simply changing the value of the variable in the query string: