Regarding allow_url_include and dynamic menu

[Johns3n]

Hello PHPfreaks!

I build a website for a company way back when I was still learning basic PHP! Now unfortunaly the webhost has decided to change their security settings, specifically chaning the allow_url_include and allow_fopen_include to off!

 

That however breaks the website that I did, since i am using the following code in calling the various menus around the website:

include(''$site_url'menu.php?menuid=1');

 

Now I am well aware that this is not the best way to include a menu! ohhh yeah btw, the code for the menu.php file is:

<?php

include('config.php');

$menuid = mysql_real_escape_string($_GET['menuid']);

$menu_categories = mysql_query("SELECT * FROM " .$db_prefix. "menucategories WHERE id='".$menuid."'");

while($menu_cat = mysql_fetch_array($menu_categories))
{
if($menu_cat['display_name'] == "")
{	
	$menu = mysql_query("SELECT * FROM " .$db_prefix. "menu WHERE cat = ".$menu_cat['id']." ORDER BY placement ASC");

	echo "<ul>";


	while($menu_rows = mysql_fetch_array($menu))
	{
	echo "<li><a href='" .$menu_rows['URL']. "' class='".$menu_cat['name']."' >" .$menu_rows['name']. "</a></li>";
	}

	echo "</ul>";
}
else
{
	echo "<h4>" .$menu_cat['display_name']. "</h4>";

	$menu = mysql_query("SELECT * FROM " .$db_prefix. "menu WHERE cat = ".$menu_cat['id']." ORDER BY placement ASC");

	echo "<ul>";


	while($menu_rows = mysql_fetch_array($menu))
	{
	echo "<li><a href='" .$menu_rows['URL']. "' class='".$menu_cat['name']."' >" .$menu_rows['name']. "</a></li>";
	}

	echo "</ul>";
}
}
?>

 

So i build the website so that you call the various menus around in the website using the menu.php include and setting a variable based on a ID (i.e menu.php?menuid=2) and of course using variables in the URL name you need to define a complete URL in the include, which now with the hosting companies new security policy doesn't work!

 

SO BASICALLY!

 

What I am trying to ask: Is there any alternative to include menu.php?menuid=XX without using the absolute URL?

[Adam]

Use the server's absolute path, not the URL.

[Johns3n]

Use the server's absolute path, not the URL.

 

And just to be a total noob here, how would i do that? Because in my book absolute URL path == Server Path

[Adam]

No, the URL path refers to "http://example.com/..." It's the public - "document" - root from where users can request files. The server path is the internal path, like for example on a *nix machine it could be "/var/www/example.com/...", or on Windows "C:\Program Files\Apache\www\example.com\..." or something along those lines.

 

Absolute just means from the root , the base, point of the path. A relative URL/path means from the current location.. I.e. "../path" means go up a directory, and "./path" means from the current directory. Using those you can set the path to any point on the server, but it's from a relative position.

 

Edit

 

Sorry to actually answer your question, you can set the include path PHP uses to include files. What's the structure like of your files? Do you have a config or header type file you include to set the $site_url variable you mentioned?

[Johns3n]

Sorry to actually answer your question, you can set the include path PHP uses to include files. What's the structure like of your files? Do you have a config or header type file you include to set the $site_url variable you mentioned?

 

Yes i do, i have a config.php file which calls connection to my mySQL db and set a variety of other variables

[Adam]

Okay - I assume you use a relative path to include this file originally? I would decide whether you actually need any complex logic to include files - is your file structure that complex you can't just use simple relative paths to include everything?

 

If so..

 

In PHP you can configure the 'include path' used by the include/require control statements. You can also set multiple include paths it will use to attempt to include the file, in the order they're stored. By default these are generally the current directory, followed by the root directory of your website - though this may not be the case on a development server you've set-up yourself, in which case it's generally the document root.

 

Better than creating a variable, that you would have to add to all your includes, would be to configure this include path so that it automatically checks a certain directory so that you don't need to add anything manually. If the path of all your PHP files that you want to include is the same as your config file, you can use this code:

 

set_include_path(
    get_include_path()
    . PATH_SEPARATOR
    . dirname(__FILE__)
);

 

That will set the include path as the already set include path, but amend it with the directory name (and path) of the special __FILE__ constant, which stores the file path of the current executing file. As I said that will only work if the PHP files you wish to include are within the same, or sub-directories of, the directory in which the config file is. If that's not the case you can add a relative path, based on the config file's directory, to set it to what you want.

 

For example, assume you have the following file structure (config is separate from the PHP purposefully):

 

site_root/

    php/

        file-i-want-to-include.php

    config/

        config.php

    html/

        index.php

 

You would want to set the include path as the "php/" directory, however you always run the config file from "config/" - it's a bit of a stupid set-up in that regard, but it's just as an example. In that case you could use the following code:

 

$include_path = dirname(__FILE__);
$include_path = realpath($include_path . '../php');

set_include_path(
    get_include_path()
    . PATH_SEPARATOR
    . $include_path
);

 

That does almost the same as before, except adds in an extra part which makes use of realpath - which can return the absolute path for any relative path you give it. In this case we add the relative path to the PHP directory from the config file, which will give us our absolute path.

 

So whichever way you set the include path, now you should be able to just include files from any location like:

 

include 'file-i-want-to-include.php';

 

Don't be put off by how much I've ranted about this, it's extremely simple once you know what you're on about.

[Johns3n]

And this would work with files that i include using variables?

 

i.e:

include('menu.php?itemid=2')

 

Because i know that include REQUIRES a absolute path to the file, when you are using URL $_GET variables

[Adam]

No include or require statement REQUIRES an absolute path. Also, you can't add get parameters to an include file like you showed. Parameters like that are a part of the HTTP protocol, which isn't used when including internal files. Any GET parameters that are passed to the originally requested file are available within the included file too.

 

So if you request "foo.php?str=Hello", then include a file, $_GET['str'] is available within the included file too. So are normal variables you define within the parent file.

[Johns3n]

Okay thanks for the help mate, it gave me some good insight to file structure and paths when using includes ^^

 

This is now solved!

 

(once again PHPfreaks delievers!)