Getting a remote file

[blackcat1313]

I would like to get a remote file using HTTP and put its contents in a local page.  The function readfile() would do this very nicely, except you have to have allow_url_fopen set On.  My understanding is that this creates a security hole and many hosts have it disabled.  There are other functions too, like file_get_contents(), but they are all going to need allow_url_fopen in order to work.

 

Is this really a security problem?

 

If so, how can I get the file?

 

Thanks!

 

  Bill Osberg 

[ratcateme]

hey check out curl i have used it before on a hosting service but i don't no if it is affected by allow_url_fopen try it and see if it works

http://nz2.php.net/manual/en/ref.curl.php

 

Scott.

[Rohan Shenoy]

Have you tried with file() function?

file() returns an array of all lines in the files. So you could loop over to render the files text.

<?php
$file=file("http://www.domainname.com/filename.html");
foreach($file as $line)
{
echo "$line<br />";
}
?>

 

[blackcat1313]

Thanks Scott, I will investigate using cURL.  First thing is to see if my web host has it installed.

 

Hi Rohan, doing it this way is going to need allow_url_fopen set on.  As would include, fopen, and any of the other file manipulation functions.

 

I think I may be able to get it using FTP, copy it locally, then use include to read it in.  So I've got a couple of things to try.  Thanks.

 

    Bill

[cooldude832]

do you want raw content (like with uncompiled scripts) or teh outputted content (a xhtml doc or a jpg etc.)

 

if you want just outputted you can use file_get_contents() on any local or remote file without a problem it retrives what ever that location's return is

[blackcat1313]

Hi cooldude, thanks but the PHP manual says that file_get_contents needs allow_url_fopen set On to use a URL as the file name.  That's what I'm trying to avoid...

 

"You can use a URL as a filename with this function if the fopen wrappers have been enabled. See fopen() for more details on how to specify the filename and List of Supported Protocols/Wrappers for a list of supported URL protocols."

 

 

[rcorlew]

Most if not all hosts have to have them enabled in order to allow users to work with their own files.

 

So,

 

file_get_contents(http://www.phpfreaks.com/index.php);

 

should just show the page the same as any user sees it on the server.

 

You may need to think of hotlinking though, most sites disable that themselves.

 

I do not really know of any of the hosts I have used in the past to have disabled $FILES operations, users however can restrict it.