|
Chapter 6. Using remote files
As long as
Note:
In PHP 4.0.3 and older, in order to use URL wrappers, you were required
to configure PHP using the configure option
Note:
The Windows versions of PHP earlier than PHP 4.3 did not support remote file accessing for the following functions: include(), include_once(), require(), require_once(), and the imagecreatefromXXX functions in the Image extension. For example, you can use this to open a file on a remote web server, parse the output for the data you want, and then use that data in a database query, or simply to output it in a style matching the rest of your website. Example 6.1. Getting the title of a remote page<?php You can also write to files on an FTP server (provided that you have connected as a user with the correct access rights). You can only create new files using this method; if you try to overwrite a file that already exists, the fopen() call will fail. To connect as a user other than 'anonymous', you need to specify the username (and possibly password) within the URL, such as 'ftp://user:password@ftp.example.com/path/to/file'. (You can use the same sort of syntax to access files via HTTP when they require Basic authentication.) Example 6.2. Storing data on a remote server<?php Code Examples / Notes » features.remote_filesheck
The previous post is part right, part wrong. It's part right because it's true that the php script will run on the remote server, if it's capable of interpreting php scripts. You can see this by creating this script on a remote machine: <?php echo system("hostname"); ?> Then include that in a php file on your local machine. When you view it in a browser, you'll see the hostname of the remote machine. However, that does not mean there are no security worries here. Just try replacing the previous script with this one: <?php echo "<?php system(\"hostname\"); ?>"; ?> I'm guessing you can figure out what that's gonna do. So yes, remote includes can be a major security problem. geoffrey
Really, you should not send headers terminated by \n - it's not per-rfc supported by a HTTP server. Instead, send as \r\n which is what the protocol specifies, and that regular expression would be matched anywhere, so match for something like /^Content-Length: \d+$/i on each header-line (headers are terminated by the regular expression /(\r\n|[\r\n])/ - so preg_split on that. Remeber to use the appropriate flags, I can't be arsed to look them up) |