Remote File Inclusion Issues

tutorials for newbie

[KatrinR]

Hello,

I started to learn php and mysql last winter and built two websites with the new gained knowledge.

Now I have problems with remote file inclusions on both websites (both located on different servers).

I read [en.wikipedia.org...] and some of the posts here, yet still don't really know how and where to start with securing my code.

Are there any web tutorials you could point me to where I could learn how to secure my php code agains attackers?

Thank you,
Katrin

[Vis3R]

As long as you have static file includes, or dynamic but selected ones, you shouldn't have a security issue with the include function. All you should take care of is that the users won't be able to change what include files your script includes.

include("myscript.php");
is safe

if ($_GET["a"] == "one")
include("one.php");
else if ($_GET["a"] == "two")
include("two.php");
is also safe

include($_GET["textbox1"]);
is not safe, because they can send anything in that textbox1 variable, and include anything they want.

[KatrinR]

In my index.php I have following code that calls all other pages.

<script language="php">
if (!isset($_REQUEST['content']))
include("content//main.inc.php");
else
{
$content = $_REQUEST['content'];
$nextpage = $content . ".inc.php";
include($nextpage);
} </script>

after reading your post, Vis3R, this seems to be the weak part of my websites, because "they can send anything in that 'content' variable"?
Is this correct?

The solution for a beginner would then be to code the pages more static with clearly defined include files?

Thank you!

[coopster]

Yes, you are correct. It is user-supplied input and can never be trusted. Always check to be sure the value being passed to you contains what you expect before you use it.

I also note you are using one of the alternative methods for invoking PHP. Although there is really nothing wrong with using that format you may want to reconsider and use the more common format, <?php
Details: Basic syntax [php.net]

[KatrinR]

My reply is late, yet I wanted to thank you for the response.

Actually, I started learning php in an online course! With what I know now, I will be more cautious when taking the intermediate class.

Katrin