File get contents returns false - php

Question

So I'm trying to have users verify that they own the domain. So I generated a file and have them upload it to their site. So I then have to verify it, so what I do is
file_get_contents($url.'/'.$token.'.html');
All this returns is
bool(false)
Here's more of the code
$url = $_POST['url'];
//Get site info
$gin = $con->prepare("SELECT * FROM verify WHERE url = :url");
$gin->bindValue(':url', $url);
$gin->execute();
//Get token
$t = $gin->fetch(PDO::FETCH_ASSOC);
$token = $t['token'];
$url = $t['url'];
//Get content
var_dump(file_get_contents($url.'/'.$token.'.html'));
I have 3 columns in the table token, which is the string in the file. url which is the url obviously, its in example.com format. And a verified column which is either 1 or 0. Any ideas?

Answer 1

Based on my experience with fetching third-party content from more than 1 million domain names, I would not recommend you to use file_get_contents() because this PHP function cannot handle page redirects, site that requires a valid user-agent etc. The issue you are experiencing might be specific to a certain domain names only. A better approach to your problem is to use curl.
function download_content($url) {
$ch = curl_init();
$timeout = 5;
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_USERAGENT, "Firefox 32.0");
$data = curl_exec($ch);
curl_close($ch);
return $data;
}
Usage:
$returned_content = download_content('http://stackoverflow.com');

Answer 2

Try to add http:// before $url and put a valid url. It will work
var_dump(file_get_contents('http://'.$url.'/'.$token.'.html')); // With a valid URL

Answer 3

If you enable error_reporting(E_ALL), then you will probably see that the use of HTTP URLs are disallowed due to an ini setting.
Warning: you are possibly opening a hole by allowing arbitrary prefixes in file_get_contents. Try to use parse_url to validate that you actually have a HTTP URL. Then you should probably consider using cURL and disable external redirects (otherwise one could pass a URL such as http://bit.ly/something# and still pass your tests).