Re: securing include()

Alexei -- ..and then Alexei Matveev said... % % Jason Wong wrote: .. % >Use basename() to strip off any leading paths leaving just the filename. % >Then prepend your own base directory % Good, but works only for one directory, % not for (multiple) subdirectories. True enough. % % Ok, I see, opne may replicate the script to serve % urlpath/?body=page1.html % urlpath/subdir/?body=page2.html % Thanks! Of course, then you have two copies of the script to maintain... % % In fact I need a content wrapper for a simple % header % body % footer % layout. Was tired of fixing include(header/footer) % everywhere. Do you include from a standard location? We use if ( file_exists ("footer.inc") ) { include ("footer.inc") ; } # standard footer stuff else if ( file_exists ( "../footer.inc" ) ) { include("../footer.inc") ; } # maybe the site-wide version else { include("/home/sites/.php/footer.inc") ; } # fall back to the master to put a standard footer on our web pages. Note that this is actually part of a master script that isn't replicated all around to have to maintain. The client's index.php is simply <?php include ("/home/sites/.php/index.inc"); ?> and all of the magic is done in one place. Better yet, we have all of our standard include()s in a single script which is then called by this main index as well as other master scripts. % % Is it possible to translate % urlpath/page1.html % into a call to php script with page1.html as % an argument? Yes, although it requires using a .htaccess file or tweaking around in your httpd config if the last part of your path isn't a .php file so that your server knows what to do with it. If you're happy with http://yourdomain.tld/path/to/script.php/param/param then you're good to go without any extra work required. HTH & HAND :-D -- David T-G * There is too much animal courage in (play) davidtg@justpickone.org * society and not sufficient moral courage. (work) davidtgwork@justpickone.org -- Mary Baker Eddy, "Science and Health" http://justpickone.org/davidtg/ Shpx gur Pbzzhavpngvbaf Qrprapl Npg!