php include() alternative?

[roly]

hi

i want to include a file (it's just a bit of javascript) from domainA into a php page on domainB (all on the same server). to do this i have to have allow_url_include = on in my php.ini which i believe is a big security risk. has anyone got any alternative solutions that are safer,?

the include is just so i can test various popups over 100's of sites by just changing the javacript in the one file. so i would be grateful for any other simple solutions too.

thanks in advance

[stocktrader23]

iframes?

[woj]

Why are you including it with php? just use a script tag with src='xxxxx'...

[Avalana]

Not sure about: require_once();

[roly]

Why are you including it with php? just use a script tag with src='xxxxx'...

because the the bit of code i am calling is a javascript with src="xxx" as well and i'm assuming you can't nest it?

[woj]

because the the bit of code i am calling is a javascript with src="xxx" as well and i'm assuming you can't nest it?

you probably can but hard to really say without knowing exactly what you are trying to do...

[Brujah]

using curl?

$ch = curl_init();
curl_setopt ($ch, CURLOPT_URL, 'http://www.domainA.com/');
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
$contents = curl_exec($ch);
curl_close($ch);
echo $contents;

[roly]

iframes?

no that doesn't seem to work

[raymor]

You want to include the server path to the file, not the URL. So something like:
include ('../../othersite.com/public_html/stuff.inc');

Symlinks on the server can simplify that.
If suexec is preventing you from doing the include, suexec a more serious security hole than fopen_url, as bad as fopen_url is.


The above is if you have to include() instead of doing:

script type="text/javascript" src="http://somesite.com/cool.js"

[u-Bob]

allow_url_include = on in my php.ini which i believe is a big security risk.

mostly a huge waste of resources if both sites are on the same server.

the include is just so i can test various popups over 100's of sites by just changing the javacript in the one file.

1. use readfile() instead of include() as the contents of the file won't need to be parsed for php code.
2. readfile("/full/path/to/whereever/u/put/thefile/file.js");

[Brujah]

You want to include the server path to the file, not the URL. So something like:
include ('../../othersite.com/public_html/stuff.inc');

Symlinks on the server can simplify that.
If suexec is preventing you from doing the include, suexec a more serious security hole than fopen_url, as bad as fopen_url is.


The above is if you have to include() instead of doing:

script type="text/javascript" src="http://somesite.com/cool.js"

Ah, I didn't catch the "same server" bit. Ray's right, you can use a server path to the files in domainA.com's path instead then.

[roly]

thanks guys for the help it's appreciated, i'm off out now, but i'll have a play around with those tomorrow and report back.

thanks again