Path: csiph.com!usenet.pasdenom.info!dedibox.gegeweb.org!gegeweb.eu!nntpfeed.proxad.net!feeder1-2.proxad.net!proxad.net!feeder1-1.proxad.net!217.188.199.168.MISMATCH!takemy.news.telefonica.de!telefonica.de!newsfeed.arcor.de!newsspool2.arcor-online.net!news.arcor.de.POSTED!not-for-mail Content-Type: text/plain; charset="UTF-8" Message-ID: <6339455.fRziDyfe1d@PointedEars.de> From: Thomas 'PointedEars' Lahn Reply-To: Thomas 'PointedEars' Lahn Organization: PointedEars Software (PES) Date: Thu, 15 Nov 2012 21:06:36 +0100 User-Agent: KNode/4.4.11 Content-Transfer-Encoding: 8Bit X-Face: %i>XG-yXR'\"2P/C_aO%~;2o~?g0pPKmbOw^=NT`tprDEf++D.m7"}HW6.#=U:?2GGctkL,f89@H46O$ASoW&?s}.k+&. <1378142.Krg0msSpID@PointedEars.de> Followup-To: comp.lang.php MIME-Version: 1.0 Lines: 62 NNTP-Posting-Date: 15 Nov 2012 21:06:36 CET NNTP-Posting-Host: 5d4eff61.newsspool1.arcor-online.net X-Trace: DXC=DT]YdiTU4:9gP]QSEBQ^d4ic==]BZ:af>4Fo<]lROoR1nkgeX?EC@@0KPeR?^YhTL7DZm8W4\YJNK0B8XYjY^ThS6``cWMaRZ1J= X-Complaints-To: usenet-abuse@arcor.de Xref: csiph.com comp.lang.php:7584 Jerry Stuckle wrote: > On 11/15/2012 10:21 AM, Thomas 'PointedEars' Lahn wrote: >> Shake wrote: >>> El 15/11/2012 13:26, Dynamo escribió: >>>> following php code to get the file contents: >>>> [ >>>> >>> $mymenu=file_get_contents('menu.txt'); >>>> echo $mymenu; >>>> ?> >>>> ] >>>> Everthing works fine but is this good practice and is there a better >>>> way. >>> >>> if the content of 'menu.txt' is HTML... the filename should be >>> 'menu.html'. >> >> And the variable is superfluous (except perhaps for debugging): >> >> > echo file_get_contents('menu.txt'); >> ?> >> >>> What you are doing is an include... you can do this way: >>> >>> >> include('menu.txt'); >>> ?> >> >> That is not equivalent to the above, because with `include' (or >> `include_once', `require', or `require_once') the content of menu.txt >> will be parsed (searched for sections which will then be >> executed). > > So? Actually, it's an advantage. For instance, he may later want to > add PHP code into the menu. He then would not need to go back and > change all his existing code. As I have explained in the part that you did not quote, it can be an advantage indeed. But if it really is only supposed to be plain text (or plain markup), using one of the include statements now can easily be a disadvantage over get_file_contents() or readfile() if the plain text happens to contain `' no matter if that was intended. I strongly suspect this is but an example (it reads like homework). If the file in question is actually user-specified, using an include statement like this instead of file_get_contents() or readfile() would allow for code injection and potentially a cross-site scripting (XSS) attack on this application or website. If the PHP section feature is to be leveraged later, the statement can still be modified to use an include statement later, after it has been ensured that code injection and XSS are not possible. PointedEars -- Anyone who slaps a 'this page is best viewed with Browser X' label on a Web page appears to be yearning for the bad old days, before the Web, when you had very little chance of reading a document written on another computer, another word processor, or another network. -- Tim Berners-Lee