Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #12781

Re: Nested PHP

Show all headers | View raw

On 2/11/2014 5:11 AM, Adrian Tuddenham wrote:
> Jerry Stuckle <jstucklex@attglobal.net> wrote:
>
>> On 2/10/2014 6:06 PM, Denis McMahon wrote:
>>> On Mon, 10 Feb 2014 21:44:02 +0000, Adrian Tuddenham wrote:
>>>
>>>> Jerry Stuckle <jstucklex@attglobal.net> wrote:
>>>>
>>>>> On 2/10/2014 3:24 PM, Adrian Tuddenham wrote:
>>>>>> I am using a php program to generate and download a webpage as an
>>>>>> HTML file, the HTML file draws its headers and navigation bar from
>>>>>> another HTML file using some embedded php with an "include" command.
>>>>>>
>>>>>> The embedded php doesn't run when the file is downloaded, so the page
>>>>>> appears in the browser without its headers or navigation.
>>>>>>
>>>>>> Is there a way of making the HTML file run the php or do I have to
>>>>>> tackle this from another angle?
>>>
>>>>> The PHP code in your generated file is only executed when the file is
>>>>> processed as a web page.  This is done by the web server, based on the
>>>>> file extension (default is .php; you do have that as the file
>>>>> extension,
>>>>> right?).
>>>
>>>> Yes -  and the same code runs perfectly well with all its headers if the
>>>> file is sitting on the server and I call it up with a browser.  It is
>>>> only if I 'create' it on the fly from a php program that it doesn't work
>>>> - the HTML runs but the php doesn't.
>>>
>>> What happens is that php script is executed by a script processor in the
>>> server, and the output of the php script is delivered by the server as
>>> html.
>>>
>>>>> Any other means of downloading the file (i.e. ftp) will not cause the
>>>>> PHP code to be executed.
>>>
>>>> I was using a browser to view it, but the source code was coming from a
>>>> php program, not directly from a file on the server.
>>>
>>> When you say "the source code was coming from a php program" do you mean
>>> that you were viewing a php script with a web browser, or do you mean
>>> that you were running a script through a php interpreter and viewing the
>>> output?
>>>
>>> Any php processing for web pages that is needed is generally carried out
>>> in a process called from the main server process in the web server.
>>> Normally when a .php file is requested, the webserver passes the file to
>>> the php processor, and takes the output of the php processor and sends
>>> that to the requesting client as html (unless another content type is
>>> specified).
>>>
>>> It's also possible for php to be embedded in html files, in which case
>>> the same thing happens for html files.
>>>
>>> I can't quite map your description of what you're doing and what you seem
>>> to expect with my knowledge of how web servers work, this suggests that
>>> either you're using the terminology in a way that I don't understand, or
>>> possibly that your perception of what is happening is not what is
>>> actually happening.
>>>
>>
>> Denis,
>>
>>   From what I can gather, he's generating a page which contains PHP code
>> from another PHP script, and sending the generated page to the browser -
>> expecting the generated PHP code to be executed (which, of course, it
>> isn't).
>
> That's right.
>

Then no, anything generated by your code is NOT processed by the 
interpreter.  It is simply sent to the client.

> I'll try to elaborate and show some of the code, which might answer many
> of the previous replies at the same time:
>
> A typical webpage in this site uses embedded php to operate the hit
> counter (PROCaddlog.php), pick up its headers (SCCSheaders.php) and pick
> up its navigation table (SCCSnavtable.php).
>
>
> ~~~~~~~ Typical webpage ~~~~~~~~
> <HTML>
> <HEAD>
>     <TITLE>Picture Gallery</TITLE>
> <meta name="KEYWORDS" content="Coal Canal, Somersetshire Coal Canal,
> Somerset Coal Canal, locks, caissons, Kennet & Avon,Weldon, Robert
> Weldon, Caisoon Lock, Inclined plane, Combe Hay, Bath, Wellow, Weldon,
> William Smith, Tuckingmill Tramway,  Dorset & Somerset Canal">
> </HEAD>
> <BODY BGCOLOR="#CCFFFF">
> <CENTER><!--NOEDIT--><?php
> include($_SERVER['DOCUMENT_ROOT'] . "/PHP/counters/PROCaddlog.php");
> addlog("Gallery");
> include("http://www.coalcanal.org/PHP/SCCSheaders.php");
> include("http://www.coalcanal.org/PHP/SCCSnavtable.php");
> ?><!--/NOEDIT-->
>
> <P><FONT COLOR="#996633"><B>GALLERY</B></FONT>
>
> <P>&nbsp;
>
> <P><A HREF="http://www.flickr.com/photos/114362147@N06/">Photostream
> on Flickr</A>
>
> <P><A HREF="gallery/gallery-old.htm">Old pictures of the canal</A>
>
> <P>&nbsp;
>
> <P>&nbsp;
>
> <P><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=5 WIDTH="100%">
>     <TR>
>        <TD>
>           <P><A HREF="index.htm">Return to home page</A>
>        </TD>
>        <TD>
>           <CENTER><A HREF="alphabetical.htm"><IMG SRC="images/Find.gif"
> WIDTH=75 HEIGHT=26 BORDER=0 ALIGN=bottom></A></CENTER>
>        </TD>
>        <TD>
>           <P ALIGN=right><A HREF="#TOP">Return to top of this page</A>
>        </TD>
>     </TR>
> </TABLE>
> </CENTER>
> </BODY>
> </HTML>
>
> ~~~~~~~~~~ End of Typical Webpage ~~~~~~~
>
> The resulting output can be seen at:
> <http://www.coalcanal.org/gallery.php>
>

Is this supposed to be the page your code has generated?  Or is this a 
file on your site?  The code here is being processed.

> I am now trying to build some password-protected pages and downloads,
> where a link to a page or PDF file calls up a page delivery program
> which decodes an encryped file and generates the PDF or page source code
> on-the-fly.  The PDF-delivery program works fine, but when I use the
> same code to deliver an HTML page, the php within the HTML appears as
> text and fails to run.
>

It won't work.

> ~~~~~~~~~~ PDF Delivery Program ~~~~~~~~~~
> <?php
>
> $cookie1 = $_COOKIE["uservalid"];
> stripslashes($cookie1);
> setcookie ("uservalid", $cookie1 , time() + 900);
> $cookie2 = strrev($cookie1);
> $filename = $_GET["url"];
> stripslashes($filename);
> $text = "Empty string";
>
> #Cookie check removed for security
> #If ($cookie2~~~~~~~~~
>          {
>          ### Read file ###
>
>          $filenamer = $filename . "r";
>                  $fh = fopen($filenamer, 'r') or ("Downloader can't open
> file $filenamer");
>                          $text = fread($fh, filesize($filenamer));
>                  fclose($fh);
>
>
>          ### Decode file ###
>
>                  # Decoding section removed for security#
>          }
>
> ### Send file or refer to Login page ###
>
> #Cookie check removed for security
> #If ($cookie2~~~~~~~~~
>          {
>          header('Content-Type: application/octet-stream');
>          header('Content-Disposition: attachment;
> filename="'.basename($filename).'"');
>          header('Content-Length: ' . filesize($filenamer));
>          print $text;
>          }
> else
>          {
>          print "
>          <HTML>
>          <HEAD>
>          </HEAD>
>          <BODY BGCOLOR='#FFFFFF'>
>          <CENTER><BR><BR>
>          <FORM ACTION=\"Login2.php\" METHOD=POST>
>          <P>Please <INPUT TYPE=submit NAME=Submit VALUE=\"Log in\">if you
> want to download this file
>          <P> <A
> HREF='http://www.coalcanal.org.uk/contactform1.php'>Contact the
> webmaster</A> if you continue to have difficulties</CENTER>
>          </BODY>
>          </HTML>
>          ";
>          }
>
> ?>
>
> ~~~~~~~~~~~~ End of PDF Delivery Program ~~~~~~~~~
>
> As suggested by one of the replies, I am currently using a modification
> of the above program to deliver webpages, whereby the 'include' is
> processed by the delivery program (not by the HTML page) and the result
> delivered to the HTML page at the appropriate point in the generated
> source code.
>
> I wondered if there was a command which I could embed instead of the
> "print $text;", which would cause the resulting HTML to be processed
> like a normal webpage, so that the php within it would also run?
>
>
>

You could use eval(), if your host allows it.  But that is a huge 
security risk.  You're just asking to be hacked.

My main question here would be - what are you trying to accomplish by 
having files encrypted on your server.  Since the decryption code is 
right in plain sight, encrypting the files adds no security.  If they 
can get to your raw files, they can get to your decryption code.

And in any case, the decrypted page (along with images, etc.) is 
available at the browser just as soon as someone requests it.

I think your whole approach needs rethinking.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-10 20:24 +0000
  Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-10 15:56 -0500
    Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-10 21:44 +0000
      Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-10 16:51 -0500
        Re: Nested PHP "Peter H. Coffin" <hellsop@ninehells.com> - 2014-02-11 08:14 -0600
          Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-11 09:27 -0500
            Re: Nested PHP "Peter H. Coffin" <hellsop@ninehells.com> - 2014-02-11 18:41 -0600
              Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-11 20:03 -0500
                Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-12 10:13 +0000
                Re: Nested PHP Tim Streater <timstreater@greenbee.net> - 2014-02-12 10:33 +0000
                Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-12 06:30 -0500
                Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-12 12:52 +0000
                Re: Nested PHP The Natural Philosopher <tnp@invalid.invalid> - 2014-02-12 13:11 +0000
                Re: Nested PHP Denis McMahon <denismfmcmahon@gmail.com> - 2014-02-13 06:55 +0000
                Re: Nested PHP "Peter H. Coffin" <hellsop@ninehells.com> - 2014-02-13 12:02 -0600
                Re: Nested PHP Stefan+Usenet@Froehlich.Priv.at (Stefan Froehlich) - 2014-02-12 12:14 +0000
      Re: Nested PHP The Natural Philosopher <tnp@invalid.invalid> - 2014-02-10 22:09 +0000
      Re: Nested PHP Christoph Michael Becker <cmbecker69@arcor.de> - 2014-02-10 23:23 +0100
      Re: Nested PHP Tim Streater <timstreater@greenbee.net> - 2014-02-10 22:27 +0000
      Re: Nested PHP Geoff Muldoon <geoff.muldoon@trap.gmail.com> - 2014-02-11 09:30 +1100
      Re: Nested PHP Denis McMahon <denismfmcmahon@gmail.com> - 2014-02-10 23:06 +0000
        Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-10 20:46 -0500
          Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-11 10:11 +0000
            Re: Nested PHP Tim Streater <timstreater@greenbee.net> - 2014-02-11 11:17 +0000
              Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-11 12:01 +0000
                Re: Nested PHP Tim Streater <timstreater@greenbee.net> - 2014-02-11 12:45 +0000
                Re: Nested PHP Christoph Michael Becker <cmbecker69@arcor.de> - 2014-02-11 13:55 +0100
                Re: Nested PHP Denis McMahon <denismfmcmahon@gmail.com> - 2014-02-11 13:29 +0000
                Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-11 14:31 +0000
                Re: Nested PHP Denis McMahon <denismfmcmahon@gmail.com> - 2014-02-11 17:24 +0000
            Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-11 08:15 -0500
              Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-11 14:31 +0000
                Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-11 10:10 -0500
                Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-11 15:31 +0000
                Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-11 11:24 -0500
                Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-12 10:13 +0000
                Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-12 06:33 -0500
                Re: Nested PHP Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-02-11 15:26 +0000
            Re: Nested PHP Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-02-11 14:41 +0000
              Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-11 15:31 +0000
                Re: Nested PHP Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-02-11 15:53 +0000
                Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-11 11:26 -0500
      Re: Nested PHP bill <william@TechServSys.com> - 2014-02-11 07:12 -0500
  Re: Nested PHP richard <noreply@example.com> - 2014-02-12 09:33 -0500
    Re: Nested PHP Denis McMahon <denismfmcmahon@gmail.com> - 2014-02-13 06:47 +0000
      Re: Nested PHP Scott Johnson <noonehome@chalupasworld.com> - 2014-02-13 05:01 -0800
        Re: Nested PHP Evan Platt <evan@theobvious.espphotography.com.invalid> - 2014-02-14 07:19 -0800
          Re: Nested PHP Scott Johnson <noonehome@chalupasworld.com> - 2014-02-14 10:43 -0800
  Re: Nested PHP Arno Welzel <usenet@arnowelzel.de> - 2014-03-02 15:54 +0100
    Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-03-02 18:10 +0000
    Re: Nested PHP The Natural Philosopher <tnp@invalid.invalid> - 2014-03-03 11:38 +0000
      Re: Nested PHP Arno Welzel <usenet@arnowelzel.de> - 2014-03-17 15:26 +0100
        Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-03-17 10:52 -0400
        Re: Nested PHP The Natural Philosopher <tnp@invalid.invalid> - 2014-03-17 15:33 +0000
          Re: Nested PHP "Peter H. Coffin" <hellsop@ninehells.com> - 2014-03-17 17:10 -0500
            Re: Nested PHP The Natural Philosopher <tnp@invalid.invalid> - 2014-03-17 23:01 +0000
              Re: Nested PHP Christoph Michael Becker <cmbecker69@arcor.de> - 2014-03-18 00:31 +0100
                Re: Nested PHP The Natural Philosopher <tnp@invalid.invalid> - 2014-03-18 13:10 +0000
  Re: Nested PHP Gabe <usenet@moojuice.net> - 2014-03-17 15:18 +0000

csiph-web