Php Security?

[xaq]

<? include "include.php?forum_id=3&post_count=7"; ?>

 

I run a phpbb forum and I have a script that takes threads (in this case 7) from a given forum (in this case 3) and posts them wherever this above it posted.

 

The thing is this doesn't run on my main page. I was thinking this was a security issue?

 

Any suggestions?

 

Thanks, X

[TCH-Thomas]

Sorry, dont know the answer, but moving for better exposure & organization.

[xaq]

it has to be a problem with <? include ... ?> part because if you go to:

 

 

http://www.angrymob.com/include.php?forum_id=3&post_count=10 you will get the 3rd forum and 10 threads.

[xaq]

as a matter of fact i can't even get simple scripts like

 

<? echo "hello"; ?>

 

to work

 

Im stumped.

[bizzar]

xag, you might want to read this thread:

http://www.totalchoicehosting.com/forums/i...0965&hl=include

 

is your .org a parked domain on a .com??

[xaq]

xag, you might want to read this thread:

http://www.totalchoicehosting.com/forums/i...0965&hl=include

 

is your .org a parked domain on a .com??

<{POST_SNAPBACK}>

 

hmm dont think so

[borfast]

Xaq, I don't think that having the variables in there will do anything, because they will not be passed into PHP like they would if you had them in an URL.

 

You'll need to declare those variables before the include() and use them inside that script.

Try something like:

><?php
  $forum_id = 3;
  $post_count = 7;
  include("include.php");
?>

 

Note that if you're accessing those URL variables with $_GET (as you should ), you'll need to change that and use only the variable names. I'm not sure if you have to declare them as global before using them or not, but try it and you'll find out

Edited December 29, 2004 by TCH-Raul

[xaq]

hmm nothing is still coming up... and i think the script im running allows you to change the variables through the url... not positive though.

 

i cant even run simple echo scripts though. would you know why?

[borfast]

Try adding error_reporting(E_ALL); to the top of the script and see if it spits any errors.

[TCH-Dick]

You need to use

><? include "http://www.angrymob.org/include.php?forum_id=3&post_count=7"; ?>

the way you have it causes the include to look for a file named "include.php?forum_id=3&post_count=7".

[xaq]

You need to use

><? include "http://www.angrymob.org/include.php?forum_id=3&post_count=7"; ?>

the way you have it causes the include to look for a file named "include.php?forum_id=3&post_count=7".

<{POST_SNAPBACK}>

 

hmm already tried that, after that didn't work I went to just using the include.php.

[xaq]

no php script will run on my site. i have no idea why.

 

<? echo "Hello"; ?>

 

^ won't even work

[TCH-Don]

Lets try something very basic.

create a text file with notepad

containing

 

<?php echo "hello"; ?>

 

 

save as hello.php and ftp it to your site,

goto your site path/hello.php

and see what happens.

[xaq]

hmm that actually worked, yet that exact script doesnt run in my index

[TCH-Don]

What is the full name of your index page

index.php or index.html ?

[xaq]

What is the full name of your index page

index.php or index.html ?

<{POST_SNAPBACK}>

 

ive tried both and i get the same result, not a thing.

[TCH-Don]

If you are to use php, the extension must be .php

unless you added something to you .htacces file to parse .htm .html for php.

 

Try index.php and use the long tags

<?php at the start of the script

I am not sure about the syntax of your include, but that will give it a chance.

[xaq]

If you are to use php, the extension must be .php

unless you added something to you .htacces file to parse .htm .html for php.

 

Try index.php and use the long tags

<?php at the start of the script

I am not sure about the syntax of your include, but that will give it a chance.

<{POST_SNAPBACK}>

 

heh that worked... long tags + index.php

 

I had index.php and <? and it didn't

 

odd... anyone know why that is?

 

 

 

 

I appreciate all the help you guys have given me

[TCH-Don]

The long tags are recommended for the future,

so I am using them all the time now.

And you might run into trouble with the short tags if your are using xhtml strict as your doctype as they are considered xml tags.

Edited December 30, 2004 by TCH-Don

[borfast]

I actually thought of that (short tags) as a possible source of the problem but after checking my account's phpinfo() output, I saw short_open_tag is turned on, so that shouldn't be a problem... I'm guessing your server has short_open_tag turned off. Either that, or you just discovered a bug in PHP