php include() alternative? - GoFuckYourself.com

roly · 11-19-2011, 09:42 AM

hi

i want to include a file (it's just a bit of javascript) from domainA into a php page on domainB (all on the same server). to do this i have to have allow_url_include = on in my php.ini which i believe is a big security risk. has anyone got any alternative solutions that are safer,?

the include is just so i can test various popups over 100's of sites by just changing the javacript in the one file. so i would be grateful for any other simple solutions too.

thanks in advance

stocktrader23 · 11-19-2011, 09:43 AM

iframes?

woj · 11-19-2011, 09:45 AM

Why are you including it with php? just use a script tag with src='xxxxx'...

Avalana · 11-19-2011, 09:46 AM

Not sure about: require_once();

roly · 11-19-2011, 09:49 AM

Quote:

Originally Posted by woj

Why are you including it with php? just use a script tag with src='xxxxx'...

because the the bit of code i am calling is a javascript with src="xxx" as well and i'm assuming you can't nest it?

woj · 11-19-2011, 09:50 AM

Quote:

Originally Posted by roly

because the the bit of code i am calling is a javascript with src="xxx" as well and i'm assuming you can't nest it?

you probably can but hard to really say without knowing exactly what you are trying to do...

Brujah · 11-19-2011, 09:52 AM

using curl?

Code:

$ch = curl_init();
curl_setopt ($ch, CURLOPT_URL, 'http://www.domainA.com/');
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
$contents = curl_exec($ch);
curl_close($ch);
echo $contents;

roly · 11-19-2011, 09:52 AM

Quote:

Originally Posted by stocktrader23

iframes?

no that doesn't seem to work

raymor · 11-19-2011, 09:54 AM

You want to include the server path to the file, not the URL. So something like:
include ('../../othersite.com/public_html/stuff.inc');

Symlinks on the server can simplify that.
If suexec is preventing you from doing the include, suexec a more serious security hole than fopen_url, as bad as fopen_url is.

The above is if you have to include() instead of doing:

script type="text/javascript" src="http://somesite.com/cool.js"

u-Bob · 11-19-2011, 09:57 AM

Quote:

Originally Posted by roly

allow_url_include = on in my php.ini which i believe is a big security risk.

mostly a huge waste of resources if both sites are on the same server.

Quote:

the include is just so i can test various popups over 100's of sites by just changing the javacript in the one file.

1. use readfile() instead of include() as the contents of the file won't need to be parsed for php code.
2. readfile("/full/path/to/whereever/u/put/thefile/file.js");

Brujah · 11-19-2011, 09:59 AM

Quote:

Originally Posted by raymor

You want to include the server path to the file, not the URL. So something like:
include ('../../othersite.com/public_html/stuff.inc');

Symlinks on the server can simplify that.
If suexec is preventing you from doing the include, suexec a more serious security hole than fopen_url, as bad as fopen_url is.

The above is if you have to include() instead of doing:

script type="text/javascript" src="http://somesite.com/cool.js"

Ah, I didn't catch the "same server" bit. Ray's right, you can use a server path to the files in domainA.com's path instead then.

roly · 11-19-2011, 11:33 AM

thanks guys for the help it's appreciated, i'm off out now, but i'll have a play around with those tomorrow and report back.

thanks again

11-19-2011, 09:42 AM	#1
roly Confirmed User Join Date: Aug 2002 Posts: 1,844	php include() alternative? hi i want to include a file (it's just a bit of javascript) from domainA into a php page on domainB (all on the same server). to do this i have to have allow_url_include = on in my php.ini which i believe is a big security risk. has anyone got any alternative solutions that are safer,? the include is just so i can test various popups over 100's of sites by just changing the javacript in the one file. so i would be grateful for any other simple solutions too. thanks in advance

11-19-2011, 09:43 AM	#2
stocktrader23 Let's do some business. Industry Role: Join Date: Jan 2003 Location: The dirty south. Posts: 18,781	iframes? __________________ Hands Free Adult - Join Once, Earn For Life "I try to make a habit of bouncing my eyes up to the face of a beautiful woman, and often repeat “not mine” in my head or even verbally. She’s not mine. God has her set aside. She’s not mine. She’s His little girl, and she needs me to fight for her by keeping my eyes where they should be."

11-19-2011, 09:45 AM	#3
woj <&(©¿©)&> Industry Role: Join Date: Jul 2002 Location: Chicago Posts: 47,882	Why are you including it with php? just use a script tag with src='xxxxx'... __________________ Custom Software Development, email: woj#at#wojfun#.#com to discuss details or skype: wojl2000 or gchat: wojfun or telegram: wojl2000 Affiliate program tools: Hosted Galleries Manager Banner Manager Video Manager Wordpress Affiliate Plugin Pic/Movie of the Day Fansign Generator Zip Manager

11-19-2011, 09:46 AM	#4
Avalana Confirmed User Industry Role: Join Date: Jun 2011 Location: Coconut Grove Posts: 594	Not sure about: require_once(); __________________ bad behavior - Adult & Porn Site Reviews - Need a honest Review for your Adult Porn Site? Just drop me a line - ICQ @BADBEHAVIOR or SKYPE avalana.porngeekz

11-19-2011, 09:52 AM	#7
Brujah Beer Money Baron Industry Role: Join Date: Jan 2001 Location: brujah / gmail Posts: 22,157	using curl? Code: $ch = curl_init(); curl_setopt ($ch, CURLOPT_URL, 'http://www.domainA.com/'); curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1); $contents = curl_exec($ch); curl_close($ch); echo $contents; __________________ Free Premium Domain Lists and Tools at Clickmojo.com For Sale: Obscenity.com

11-19-2011, 09:54 AM	#9
raymor Confirmed User Join Date: Oct 2002 Posts: 3,745	You want to include the server path to the file, not the URL. So something like: include ('../../othersite.com/public_html/stuff.inc'); Symlinks on the server can simplify that. If suexec is preventing you from doing the include, suexec a more serious security hole than fopen_url, as bad as fopen_url is. The above is if you have to include() instead of doing: script type="text/javascript" src="http://somesite.com/cool.js" __________________ For historical display only. This information is not current: support@bettercgi.com ICQ 7208627 Strongbox - The next generation in site security Throttlebox - The next generation in bandwidth control Clonebox - Backup and disaster recovery on steroids

11-19-2011, 11:33 AM	#12
roly Confirmed User Join Date: Aug 2002 Posts: 1,844	thanks guys for the help it's appreciated, i'm off out now, but i'll have a play around with those tomorrow and report back. thanks again