php includes - HTML Forums

johnz · 01-15-2007, 04:58 PM

To use PHP Includes, the first thing you will have to do is rename all your .html files to .php.

After you've done that, the concept is pretty simple. Lets say you wanted to include navigation to all your pages. You would code your pages just like you would normally. When you reach the part in your page where your navigation would go, you use the include.

PHP Code:


			
<?php include("yournavfile.html"); ?>

so lets say you had a page like this:

HTML Code:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252" />
<title></title>
</head>
<body>

<div id="wrap">
	
	<div id="top"></div>
	
	<div id="main">
		
		<ul id="nav">
			<li><a href="page1.php">Link1</a></li>
			<li><a href="page2.php">Link2</a></li>
			<li><a href="page3.php">Link3</a></li>
			<li><a href="page4.php">Link4</a></li>
			<li><a href="page5.php">Link5</a></li>

		</ul>
		
	<div id="footer"></div>

</div>
</body>
</html>

Instead of inserting your navigation into every one of your pages, you can just use the include from above.

So now your page should look like this:

HTML Code:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252" />
<title></title>
</head>
<body>

<div id="wrap">
	
	<div id="top"></div>
	
	<div id="main">
		
		<ul id="nav">
			<?php include("navigation.html"); ?>
		</ul>
		
	<div id="footer"></div>

</div>
</body>
</html

The file that you are including (navigation.html) will contain the code that you want included:

HTML Code:

<li><a href="page1.php">Link1</a></li>
<li><a href="page2.php">Link2</a></li>
<li><a href="page3.php">Link3</a></li>
<li><a href="page4.php">Link4</a></li>
<li><a href="page5.php">Link5</a></li>

Pegasus · 03-17-2007, 01:59 AM

Okay, I'm a bit thick on this. The pages that have includes in them are to be given the .php extension and the includes themselves are to be .html pages? Right?

Now, what happens if I have the include inside a <div> and that <div> has special CSS formatting? Will the .php page read the CSS properly? If not, how do I get the linked CSS information to the appropriate include?

erisco · 03-17-2007, 11:10 AM

Peg, well actually the file you include can be whatever extension you please.

Hmm. Let's assume this is our div in index.php.

HTML Code:

<span style="color:#990000">
<?php include('warning.inc'); />
</div>

.inc is just a popular extension for php includes when including text and the like. So now let's assume warning.inc looks like this....

HTML Code:

Abandon Ship!!

When someone on the Internet requests your index page PHP fires up and outputs this to your server:

HTML Code:

<span style="color:#990000">
Abandon Ship!!
</div>

Then your server outputs that to the person's browser. After the browser has it then it reads the CSS, it reads the text, and you now have something like Abandon Ship!!

PHP plays no part on how the browser reads the page. This is because, as you can see, the browser never gets to see any PHP. You would get this same effect if you just statically wrote:

HTML Code:

<span style="color:#990000">
Abandon Ship!!
</div>

on an .html page.

Pegasus · 03-28-2007, 03:02 PM

Another question, I think. Some of my pages have anchor links to other pages. The link looks like this: <a href="page.php#section">Page Section</a>

The PHP page has an include for the content. It reads: <?php include("content.html"); ?>

By your logic, the anchor link should arrive at the correct anchor without a hitch, right?

Peg

erisco · 04-02-2007, 10:26 PM

So long as the id "section" exists on the page, yes

Pegasus · 04-03-2007, 12:52 AM

There's an <a name="section"> (or whatever the section name happens to be) on each place, yes.

Okay, I think I've got it figured out. Thanks.

Peg

JoeyD · 07-29-2008, 04:47 PM

Uh... yeah... only i just discovered if you're using dynamic includes based on user input, e.g.,

PHP Code:


			
<?php  

include($_GET['page']);  

?>

... it's a potential disaster.

Sample exploit:
h ttp://yoursite.com/index.php?content=../../../../../insecure_php_scripts/shell_access.php

The place i found that gave me a simple solution as so:

PHP Code:


			
if ( substr( $_GET['content'] , 0 , 1 ) != '.' ) // nothing starting with a period is allowed, preventing backing out of a directory.

include( 'includes/' . $_GET['content'] );

...and there's more on the subject here.

/JoeyD goes off to fix a bunch of web pages...

erisco · 10-10-2008, 10:34 PM

JoeyD, that is not a safe way to protect against this. I could easily start with a forward slash or easily enter a parent directory and return back to the child. The way to protect against this is to make sure the path begins with an expected root path.