Forum Moderators: coopster
Any inputs will be appreciated.
There should be plenty of results to tell you (and those who use your system) how to do what they need to. It's usually either AddType or AddHandler in the .htaccess. There's another way to do it with mod_rewrite, but those are probably the best.
They would insert the PHP (or whatever) onto their own pages.
You are wise to re-assess rainborick's comment. Although the standard reaction is "my users won't ever do that" it's not your legitimate users you need to worry about. If you do allow this, you will have to be extremely careful with exactly **what** PHP code is allowed to slip through.
Instead, you should be looking for every way possible to prevent people from being able to execute their own code on your server.
It only takes one spammer to discover your site allows it and every blackhat spammer in Russia, China, Romania, and elsewhere will soon know about it.
A Note: It's very difficult to do, but you *can* do what you need to with them being able to enter information on their site... How difficult? I wrote a system a few years ago that did it and without looking at it and digging through the code I can't remember how. It has to do with php files, txt files, mod_rewrite, the server parsing each file and the processing order of the files, but that's the best I can tell you off the top of my head.
Any code they are told to include on their pages is only available via instructions given to them after they have successfully logged into their account with a username and password.
At the top of the page they would be instructed to include something like
<?php
include_once(<path to an include file residing on MY webserver>);
$var = new myclass("user_id","project_name"); // neither string contains passwords, SQL etc.
Then at specific places in the same web page, they are instructed to include:
<>php myclass->method(#); // where # is a digit in range 1 to 9 and not an ID, password, piece of SQL or anything like that
I personally can't see how any of the above is unsafe unless is would be possible for any potential hacker to view the content (in terms of the PHP) of the include file, but then again I am not an expert in this area.
<?php myclass->method(#); // where # is a digit in range 1 to 9 and not an ID, password, piece of SQL or anything like that
?>
$var = new myclass("user_id","project_name") and myclass->method(#) (see above)
and then it looks like everything will be hacker-proof. Will it not?
I'd have two files involved; one a template which is all they can access via FTP, and the second a bit of parsing code, which is PHP that only you can access. Don't give them any permission to create files in a PHP enabled path.
At the top of the template they can specify:
userid=44
project_name=foo
Your code can do a preg_match to pull those out and remove them from the output.
In the template they might write: "**METHOD4**
Your code would recognise that and str_replace it with the result of ->method(4)
Or have I totally misunderstood something here?
If you are talking about references / includes between two servers or sites, you cannot usually write:
include("http://foo.bar/something.php");To 'include' a file from another server or site, you will need to output that file as plain text and then parse it with eval(). eval(file_get_contents("http://foo.bar/something.txt")); where something.txt is your PHP source code.
<script src="http://foo.bar/load.php?argument=4&argumentb=44"></script>You can then do all kinds of beautiful stuff client side. Your load.php file should output JAVASCRIPT not HTML. That allows you to insert content into the page or even edit content already on the page.
Where foo.bar is your server, and the arguments are whatever details are required to load the right data. If you need more security, use a hash or something similar.
Think of, for example, Google Adsense - it modifies the page (by adding adverts) - loading them fresh each time from Google via the javascript inclusion. This is what I would advise in most cases.
One thing I didn't clarify is that each time the user's page is refreshed, it should re-access the database so the same data is not necessarily presented each time.
Is your recommendation (to use javascript) because you think my PHP based solution is open to hackers?
However, Javascript is a good way to do what I suspect you do want to do.
I will try to explain again:
Your server contains a script 'foo.bar/load_data.php'
It accepts some basic parameters which request the right output ('foo.bar/load_data.php?a=44&b=31)
It outputs Javascript not HTML. Yet; it is PHP and so its output is directly driven by your database on your server.
This load_data.php is included into the client's website using <script src=""></script>. That is a client side instruction and the end visitor's computer will get the script directly from YOUR server, and that script will output its data (or whatever) directly into the website that included it.
