Comments on: PHP Security and YOU – Including files the right way http://www.hostnexus.com/blog/php-security-and-you-including-files-the-right-way/ Status Updates, Rants, Musings and Real Advice for Webmasters Sun, 05 Feb 2012 03:19:52 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Robert Spriggs http://www.hostnexus.com/blog/php-security-and-you-including-files-the-right-way/#comment-840 Robert Spriggs Wed, 02 Mar 2011 23:55:13 +0000 http://www.hostnexus.com/blog/?p=483#comment-840 I'm with Alex as to why should you ever "include" a remote file. I don't think I've ever done it - or if I did, it was when I was more naiave (however you spell it ). A simple rule is if you get something from a remote server use CURL. Always. Then parse and understand the contents before doing what you need. A small side-note. It's amazing how few developers actually know what readfile() does. It's one of my interview questions for senior PHP developers - can you explain the difference between readfile(), include(), include_once(), require() and require_once(). It has only once (in a lot of interviews) been answered correctly. Only once. Most poeple get it confused with get_file_contents(). Also never eval() remote or uncensored code. That's inviting danger even more than including remote files. Look after the shared servers ;) I’m with Alex as to why should you ever “include” a remote file. I don’t think I’ve ever done it – or if I did, it was when I was more naiave (however you spell it ).

A simple rule is if you get something from a remote server use CURL. Always. Then parse and understand the contents before doing what you need.

A small side-note. It’s amazing how few developers actually know what readfile() does. It’s one of my interview questions for senior PHP developers – can you explain the difference between readfile(), include(), include_once(), require() and require_once(). It has only once (in a lot of interviews) been answered correctly. Only once. Most poeple get it confused with get_file_contents().

Also never eval() remote or uncensored code. That’s inviting danger even more than including remote files.

Look after the shared servers ;)

]]> By: Alex http://www.hostnexus.com/blog/php-security-and-you-including-files-the-right-way/#comment-838 Alex Sat, 19 Feb 2011 19:05:17 +0000 http://www.hostnexus.com/blog/?p=483#comment-838 The best solution is not to include remote files. I mean why would someone do that? If you really need to include a file from a remote host, like you said, you can read the file then parse the need coded yourself instead of blindly executing it. The best solution is not to include remote files. I mean why would someone do that?

If you really need to include a file from a remote host, like you said, you can read the file then parse the need coded yourself instead of blindly executing it.
Alex´s last [type] ..Salonul de manichiura

]]>