Re: PHP include security

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 18 April 2010 02:08, Micky Hulse <mickyhulse.lists@xxxxxxxxx> wrote:

> Hi Michiel! Thanks for the help, I really appreciate it. :)
>
> > It depends. What's exactly do you want to prevent? It doesn't seem like a
> > ...<snip>...
> > include, say, additional HTML content, use file_get_contents() instead.
>
> Very good points. My goal was to write a plugin that would allow me to
> include some static HTML template file and get the <?php include...?>
> tags out of my CMS template. With that said, I think the only people
> using this code will be the developers of the templates, and not your
> standard user.
>
> I opted to use output buffering and readfile() for the speed, and
> include() would be an option if developers want to execute the code in
> the included file.
>
> Would file_get_contents() be faster than readfile and output
> buffering? Would using file_get_conents() and eval() be faster than
> using include() and output buffering?
>

I would prefer to use include() since it runs the code in the same context,
and using both file_get_contents() and eval() is a bit of a detour. eval()
also tends to be a lot slower than included code (though I'm not exactly
sure how slow).

I'm also not entirely sure whether file_get_contents() is slower than
readfile(), but file_get_contents() is useful if you want to do something
with your data rather than printing it right away.

Michiel

[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux