PHP Head Scratching Question

[hank9481]

Okay PHP gurus, I have an odd one here that I need some help with.

 

I run a site that uses a dynamic web-based program known as B.O.S.I. (Baseball Online Statistical Interface). We have been using the following url for BOSI (majorbaseballleague.com/bosi/standings.php?G_lid=1) for some years but are converting to a new site and server because of problems with the current one. Nonetheless, BOSI on the old server works fine.

 

Now, very quickly, here's how BOSI works. On my local machine, I run a batch file utility that creates about 15 .csv files of assorted statistics and information. I upload these files to my server into my /imports/ directory. I then login to these BOSI pages and use the web-based utility which converts these .csv files to .sql files and imports them into the various tables in my MySQL database. What you then see in the above link is the output of those tables of which I am sure you are all very familiar.

 

Here's the problem though. Upon installing to my new site (mblsim.com/bosi/standings.php?G_lid=1), BOSI shows up just fine; however, when I attempt to use the web utility to being the conversion and import process, it tells me that it cannot find the files in the /exports/ folder. They are, however, clearly in that folder => (mblsim.com/exports/)

 

Does anyone have any clue as to why this would work on one site but not the other? This has perplexed me far too long, and I need major help. Someone please help me! I'll be willing to send anything necessary your way to review including the BOSI files. Thanks in advance!

 

Hank Holloway

[AndyB]

first guess - register_globals is OFF on the new server (that's the default setting for register_globals in current/recent versions) and your script assumes register_globals is ON (which used to be the default years ago)

 

If that's the case, you typically need to retrieve URL passed parameters from the $_GET array, i.e

 

<?php
// standings.php
$G_lid = $_GET['G_lid'];
...

[hank9481]

Andy,

 

I'm very much a beginner in terms of PHP but I did do some research on this very issue. I installed a php info page too at www.mblsim.com/phpinfo.php and it is saying register globals is on, which I found odd.

 

What do you mean by you typically need to retrieve URL passed parameters from the $_GET array, i.e?

 

[AndyB]

ON does seem strange, especially as it's a package with recent MySQL and GD support.  My guess is the host got fed up with people complaining about 'broken scripts' and exposed everyone to the security risk instead of suggesting the host customers upgrade their scripting practices and old scripts.

 

If register_globals is OFF, then variables passed by POST or GET (forms or URL link) only exist in the $_POST or $_GET arrays rather than globally.  Since your server claims register_globals is ON, all your variables are available globally - an obvious security risk.

[hank9481]

You more than lost me!

 

Nonetheless, I don't understand why on one site it works and on the new one, it's saying it can't find the file.

[hank9481]

I now know that allow_url_fopen is disabled on the new server. Does anyone know how to enable it or could potentially help me with curl on one of the files? Once I have an example to go by, I can take it from there, but I have no clue what I am doing prior to that.