Re: PHP include security

On 18 April 2010 02:08, Micky Hulse <mickyhulse.lists@gmail.com> wrote: > Hi Michiel! Thanks for the help, I really appreciate it. :) > > > It depends. What's exactly do you want to prevent? It doesn't seem like a > > ...<snip>... > > include, say, additional HTML content, use file_get_contents() instead. > > Very good points. My goal was to write a plugin that would allow me to > include some static HTML template file and get the <?php include...?> > tags out of my CMS template. With that said, I think the only people > using this code will be the developers of the templates, and not your > standard user. > > I opted to use output buffering and readfile() for the speed, and > include() would be an option if developers want to execute the code in > the included file. > > Would file_get_contents() be faster than readfile and output > buffering? Would using file_get_conents() and eval() be faster than > using include() and output buffering? > I would prefer to use include() since it runs the code in the same context, and using both file_get_contents() and eval() is a bit of a detour. eval() also tends to be a lot slower than included code (though I'm not exactly sure how slow). I'm also not entirely sure whether file_get_contents() is slower than readfile(), but file_get_contents() is useful if you want to do something with your data rather than printing it right away. Michiel