PDA

View Full Version : php includes

johnz
01-15-2007, 04:58 PM
To use PHP Includes, the first thing you will have to do is rename all your .html files to .php.

After you've done that, the concept is pretty simple. Lets say you wanted to include navigation to all your pages. You would code your pages just like you would normally. When you reach the part in your page where your navigation would go, you use the include.

<?php include("yournavfile.html"); ?>

so lets say you had a page like this:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252" />
<title></title>
</head>
<body>

<div id="wrap">

<div id="top"></div>

<div id="main">

<ul id="nav">
<li><a href="page1.php">Link1</a></li>
<li><a href="page2.php">Link2</a></li>
<li><a href="page3.php">Link3</a></li>
<li><a href="page4.php">Link4</a></li>
<li><a href="page5.php">Link5</a></li>

</ul>

<div id="footer"></div>

</div>
</body>
</html>


Instead of inserting your navigation into every one of your pages, you can just use the include from above.

So now your page should look like this:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252" />
<title></title>
</head>
<body>

<div id="wrap">

<div id="top"></div>

<div id="main">

<ul id="nav">
<?php include("navigation.html"); ?>
</ul>

<div id="footer"></div>

</div>
</body>
</html

The file that you are including (navigation.html) will contain the code that you want included:
<li><a href="page1.php">Link1</a></li>
<li><a href="page2.php">Link2</a></li>
<li><a href="page3.php">Link3</a></li>
<li><a href="page4.php">Link4</a></li>
<li><a href="page5.php">Link5</a></li>
Pegasus
03-17-2007, 01:59 AM
Okay, I'm a bit thick on this. The pages that have includes in them are to be given the .php extension and the includes themselves are to be .html pages? Right?

Now, what happens if I have the include inside a <div> and that <div> has special CSS formatting? Will the .php page read the CSS properly? If not, how do I get the linked CSS information to the appropriate include?
erisco
03-17-2007, 11:10 AM
Peg, well actually the file you include can be whatever extension you please.

Hmm. Let's assume this is our div in index.php.
<span style="color:#990000">
<?php include('warning.inc'); />
</div>
.inc is just a popular extension for php includes when including text and the like. So now let's assume warning.inc looks like this....
Abandon Ship!!
When someone on the Internet requests your index page PHP fires up and outputs this to your server:
<span style="color:#990000">
Abandon Ship!!
</div>
Then your server outputs that to the person's browser. After the browser has it then it reads the CSS, it reads the text, and you now have something like Abandon Ship!!

PHP plays no part on how the browser reads the page. This is because, as you can see, the browser never gets to see any PHP. You would get this same effect if you just statically wrote:
<span style="color:#990000">
Abandon Ship!!
</div>
on an .html page.
Pegasus
03-28-2007, 03:02 PM
Another question, I think. Some of my pages have anchor links to other pages. The link looks like this: <a href="page.php#section">Page Section</a>

The PHP page has an include for the content. It reads: <?php include("content.html"); ?>

By your logic, the anchor link should arrive at the correct anchor without a hitch, right?

Peg
erisco
04-02-2007, 10:26 PM
So long as the id "section" exists on the page, yes :)
Pegasus
04-03-2007, 12:52 AM
There's an <a name="section"> (or whatever the section name happens to be) on each place, yes.

Okay, I think I've got it figured out. Thanks.

Peg
JoeyD
07-29-2008, 04:47 PM
Uh... yeah... only i just discovered if you're using dynamic includes based on user input, e.g.,
<?php
include($_GET['page']);
?>
... it's a potential disaster.

Sample exploit:
h ttp://yoursite.com/index.php?content=../../../../../insecure_php_scripts/shell_access.php

The place i found that gave me a simple solution as so:
if ( substr( $_GET['content'] , 0 , 1 ) != '.' ) // nothing starting with a period is allowed, preventing backing out of a directory.
include( 'includes/' . $_GET['content'] );

...and there's more on the subject here (Also see: http://blog.php-oop.net/tutorials/what-you-should-know-about-dynamic-includes).

/JoeyD goes off to fix a bunch of web pages...
erisco
10-10-2008, 10:34 PM
JoeyD, that is not a safe way to protect against this. I could easily start with a forward slash or easily enter a parent directory and return back to the child. The way to protect against this is to make sure the path begins with an expected root path.
Pegasus
11-21-2009, 01:04 AM
Okay, I have another silly question. This include works:

<?php include("header.php"); ?>

This does not:

<?php include("../header.php"); ?>

Why and what's my work around for it?