Forum Moderators: coopster
If you can get by without it, turn it off because it provides very real protection.
When you are including a file from the same website, you do not have to use the full URL, and should not.
If you're including a file from another website, ask yourself whether it's really necessary to do it that way. If it's a static file from another site you manage, you could make a local copy of the file and include it without the URL.
There are some situations where you might have to include by URL, but always try to find an alternative method first.
In php.ini, the correct command is:
allow_url_fopen = Off
In PHP5.2 or greater, you can also use this:
allow_url_include = Off
If you could do it with .htaccess in PHP5, the correct commands would be:
php_flag allow_url_fopen Off
php_flag allow_url_include Off
If you have PHP6 or higher, the above commands should work in .htaccess.
[edited by: SteveWh at 10:55 am (utc) on Mar. 3, 2009]
will server the same show
<?php
phpinfo();
?>
and ENABLED variables even I put:
php_value allow_url_fopen Off
php_value allow_url_include Off
Currently they have ON and if I put code within file it will still show ON.
For variables that have On/Off values, you are supposed to use php_flag.
All you need to do is change php_value to php_flag.
Where are you setting these values, php.ini or .htaccess?
(The commands you use in php.ini are not the same ones you use in .htaccess.)
Are you sure that your host allows modifying PHP settings?
Q: Where are you setting these values, php.ini or .htaccess?
(The commands you use in php.ini are not the same ones you use in .htaccess.)
A: this code is set within .htaccess
Q:Are you sure that your host allows modifying PHP settings?
A: Yes, they advised me as PHP is vulnerable if not OFF.But I do not see where I can see this result with PHP code.
They told me:
info.php file shows the SERVER php variables, not your account's
info.php shows me:
Master Local
allow_url_fopen OnOn
allow_url_includeOnOn
Create a text file called: php.ini with these 2 lines in it:
allow_url_fopen = Off
allow_url_include = Off
Put php.ini in the top folder of your website, the same folder where your .htaccess file and your website's home page are.
Then run phpinfo().
In PHP5.2 or greater, you can also use this:
allow_url_include = Off
That is in php.ini only. Not .htaccess. You cannot set these in .htaccess in PHP 5.2.6. It won't work.
If your host has some connection between the two, I think it would be very strange.
