put config in secure place, can not link the files - php

Am trying to use a config file for a database and rating script but the problem is the config file is in this directory :
website.com/include/config.php aka websitename/include/config.php
The rating script needs the config and is accessed like this:
include_once("config.php");
I want the config to be in:
"/files/website/"
A directory level up from the website root folder.
I have been trying with:
"../files/website/" and other variations but can not figure out how to link them.
I have managed to put one config file and access it, but with this ajax rating script the only way for it to work is to have the config in the /include/ folder next to:
rating_process.php - has this link : include("inc/config.php");
rating_functions.php - has this link : include_once("config.php");
rating_total_functions.php - has this link : include("inc/config.php");
Hope i've explained myself here
Right, looking at my hosting now:
$_SERVER['DOCUMENT_ROOT']; outputs this: /foldy/homepages/11/username/htdocs/webbysite
My index file is located at: /foldy/homepages/11/username/htdocs/webbysite/index.php
The included rating script is located in: /foldy/homepages/11/username/htdocs/webbysite/include/
I want the config to be in /foldy/homepages/11/username/htdocs/secretfiles/config.php
Am trying to some how go out of: webbysite folder and then into secretfiles (sibling folders)
I have tried adding ../ and so on, but am missing something obviously :(

Try
$configLocation = $_SERVER['DOCUMENT_ROOT'].'../files/website/config.php';
include_once($configLocation)

but the problem is the config file is in this directory
it is not a problem at all.
just keep it as is.
Concerning your particular problem, your problem is that you don't know where you want to put your file. /files/website/ is not likely a right path and it is apparently not one level high from webroot.
So, first of all make your mind about the right path to the directory and it's relative position to the web root

if you are concerned about security ( because your config file contains the db details ) i would place the db config file outside the site root folder and then require_once('../../dbConfig.php') from the script that's creating xml or json for your ajax
more exactly ...
your site folder might be here: /var/www/html
set a virtual host (done differently on Linux and Windows) and point your domain to a sub folder inside /html so that the new path to the site root is /var/www/html/site.
then place your config file in /var/www/html and call it from your scripts inside your /site folder using require_once('../dbConfig.php)`.
your db details are outside the site folder

Related

How can i Include a php file in a directory which contain include('xyz.php'); from another directory?

My directory listing is: Users>Images>PreDefines
Where i am creating a php file i.e. index.php in PreDefines Folder. I want to include a php file from Users Folder i.e include('header.php');.
But There is a problem. header.php file contain include('title.php'); which not coming in PreDefines>index.php what should i do to include a file from another directory which includes others php files also.
you can simply navigate with ../ which means go backward one step and then go wherever you want
Assuming you are in Users/Images/Predefines/index.php and you want to include a file in Users you say include('../../header.php');
Or for example you have another folder in users called assets which has a file index.php.
You do: include('../../assets/index.php);
Always include in absolute to the directory you are working on.
Something that might help php has getcwd() which returns the current working directory.
Also if you are going to change the server such as from windows to linux or other type of servers instead of / use the DIRECTORY_SEPARATOR constant which will place a separator according to your server for example
include('..'.DIRECTORY_SEPARATOR.'title.php')
Hope i understood your question

Admin function with one PHP config file

This might be hard to explain but I am looking for the best method of having one or a group of config files so if I need to update something its a little easier to do.
I have wrote a PHP application that has a sub folder for the admin side off the root folder and includes folder that is sub folder off the root folder as well .(see below)
the include folder has database config files, loads common variables and so forth. the problem is the path for the admin files that call for the database connection are obviously different than the files in the root folder.
so I started this but now I wonder if there is a better method than the route I am going.
`if($adminfile=="yes")
{
require('../includes/database/connect.db.php');
}
else{
require('includes/database/connect.db.php');
}`
I would really appreciate some advice, should I scrap this idea and have 2 location for the config file? Part of me hates to include in all the standard code $adminfile="no" I keep thinking is there a better way.
How do others solve this problem?
Check the value of your include_path in php.ini or your local config (via .htaccess for apache is another way to do it. If you add the path to demo to the include_path setting, then:
include('includes/database/connect.db.php');
or
require_once('includes/database/connect.db.php');
Will work from any file or sub folder.
Another way to do this is to include a single bootstrap file that has all the settings (i.e. not just your database ones) in your scripts.
A better way to do this is to route all your requests through a Front Controller that does anythign setup/teardown you need on every request. See PHP Front Controllers
you can define a constant in every file ... which defines the root folder you have
define('root', 'demo/');
and do
require(root.'includes/database/connect.db.php');
and this will work fine with any file you want to require

Include php files when they are in different folders

Most of my website is in my root directory. And In that directory there is "css", "functions", "images" folder. Everything works fine when I include php files within index.php or any other root file. It includes it fine and executes it fine.
But problem occurres when I made folder "blog". So this is totally new and separate root folder with CMS and its own "root" files. And I try to include css from main root directory or some php files from "functions" folder in main root directory, Everything breaks down. I know I have to include it as ../functions/myfile.com. But this files includes some other files so it just wont work properly and won't be able to include other files properly.
Is there any idea how to fix this problem?
You can get to the root from within each site using $_SERVER['DOCUMENT_ROOT']. For testing ONLY you can echo out the path to make sure it's working, if you do it the right way. You NEVER want to show the local server paths for things like includes and requires.
Site 1
echo $_SERVER['DOCUMENT_ROOT']; //should be '/main_web_folder/';
Includes under site one would be at:
echo $_SERVER['DOCUMENT_ROOT'].'/includes/'; // should be '/main_web_folder/includes/';
Site 2
echo $_SERVER['DOCUMENT_ROOT']; //should be '/main_web_folder/blog/';
The actual code to access includes from site1 inside of site2 you would say:
include($_SERVER['DOCUMENT_ROOT'].'/../includes/file_from_site_1.php');
It will only use the relative path of the file executing the query if you try to access it by excluding the document root and the root slash:
//(not as fool-proof or non-platform specific)
include('../includes/file_from_site_1.php');
Included paths have no place in code on the front end (live) of the site anywhere, and should be secured and used in production environments only.
Additionally for URLs on the site itself you can make them relative to the domain. Browsers will automatically fill in the rest because they know which page they are looking at. So instead of:
<a href='http://www.__domain__name__here__.com/contact/'>Contact</a>
You should use:
<a href='/contact/'>Contact</a>
For good SEO you'll want to make sure that the URLs for the blog do not exist in the other domain, otherwise it may be marked as a duplicate site. With that being said you might also want to add a line to your robots.txt file for ONLY site1:
User-agent: *
Disallow: /blog/
Other possibilities:
Look up your IP address and include this snippet of code:
function is_dev(){
//use the external IP from Google.
//If you're hosting locally it's 127.0.01 unless you've changed it.
$ip_address='xxx.xxx.xxx.xxx';
if ($_SERVER['REMOTE_ADDR']==$ip_address){
return true;
} else {
return false;
}
}
if(is_dev()){
echo $_SERVER['DOCUMENT_ROOT'];
}
Remember if your ISP changes your IP, as in you have a DCHP Dynamic IP, you'll need to change the IP in that file to see the results. I would put that file in an include, then require it on pages for debugging.
If you're okay with modern methods like using the browser console log you could do this instead and view it in the browser's debugging interface:
if(is_dev()){
echo "<script>".PHP_EOL;
echo "console.log('".$_SERVER['DOCUMENT_ROOT']."');".PHP_EOL;
echo "</script>".PHP_EOL;
}
If I understand you correctly, You have two folders, one houses your php script that you want to include into a file that is in another folder?
If this is the case, you just have to follow the trail the right way.
Let's assume your folders are set up like this:
root
includes
php_scripts
script.php
blog
content
index.php
If this is the proposed folder structure, and you are trying to include the "Script.php" file into your "index.php" folder, you need to include it this way:
include("../../../includes/php_scripts/script.php");
The way I do it is visual. I put my mouse pointer on the index.php (looking at the file structure), then every time I go UP a folder, I type another "../" Then you have to make sure you go UP the folder structure ABOVE the folders that you want to start going DOWN into. After that, it's just normal folder hierarchy.
i had the same issue and found a code on https://css-tricks.com/php-include-from-root/ that fixed it
<?php
$path = $_SERVER['DOCUMENT_ROOT'];
$path .= "/common/header.php";
include_once($path);
?>
None of the above answers fixed this issue for me.
I did it as following (Laravel with Ubuntu server):
<?php
$footerFile = '/var/www/website/main/resources/views/emails/elements/emailfooter.blade.php';
include($footerFile);
?>
Try to never use relative paths. Use a generic include where you assign the DocumentRoot server variable to a global variable, and construct absolute paths from there. Alternatively, for larger projects, consider implementing a PSR-0 SPL autoloader.

how to use config file from a subdirectory while it is been kept at root directory in PHP

I am developing a web application. contents are:
root dir (/var/www/)
config.php
index.php
details.php
admin dir (/var/www/admin)
admin.php
I have included config.php file into index.php, details.php in root directory using require_once('config.php') as this file contains database passwords, styles, images directory paths..
how can i include that config files in my admin/admin.php file so that one config file can be used in anywhere(even in subdirectories) of my web application. Will it make any difference for the value of define('APP_BASE_PATH', dirname(__FILE__)); when same config file is used by all files in the web application.
if i am wrong somewhere then please get me right.
If your server properly configured, just
include $_SERVER['DOCUMENT_ROOT']."/config.php";
anywhere
You have also 2 other possible ways.
a Front controller setup, where ALL user requests going into one file. And ths one going to include all others from their subdirectories. Personally I don't like it cause this front file become a mess. Though it's widely used.
I decided not to mention it because noone would use a hardcoded full path anyway.
Update after clarification in comments: You are looking for a way to include a central configuration file from anywhere in your project's folder structure.
#Col. Shrapnel shows one way, DOCUMENT_ROOT. It's the only way to use an "absolute" path from a nested folder structure. It has the limitation I describe above, but it's fine otherwise.
If you want maximum portability (i.e. the possibility to run the app with e.g. www.example.com/myapp/version_1 as its root directory), you would have to use relative references from within your folder structure to "climb down" to the config file, e.g. ../../config.php that will work reliably too, although be a bit cumbersome e.g. if you move a script to a different folder and you have to update the relative path.
you can use the same config file every time... using "/" will take you back to the root directory... so in admin/admin.php use this:
require_once("/config.php");
you can use "../" to take you up one directory eg:
require_once("../config.php");
was this what you were looking for?

PHP cannot find my php files if not under htdocs folder

By someone's advice I've put all my PHP files in a separate folder (inc) on the same level as htdocs. Only index.php is left in htdocs. So, it's like this:
C:\myproject\htdocs
- index.php
C:\myproject\inc
- login.php
- util.php
- register.php
...
Now, when I go to localhost in my browser index.php is processed and shown correctly. But any links to other php files are not found. I tried to prepend links with "inc", but they're still not found. What should I do?
My php.ini file has this line (it's on Windows):
include_path = ".;C:\myproject\inc"
The point of an include directory is to put files you don't want to be accessible by a Webserver. If login.php needs to be accessible via a URL like:
http://yourdomain.com/login.php
then don't put login.php in the include directory. Putting util.php in an include directory makes sense because you never want this:
http://yourdomain.com/util.php
You can't put web-accessible files outside the htdocs folder, you should be using the 'inc' folder for files like 'database_functions.inc' which should not be opened directly in your browser:
http://localhost/index.php // directly accessible - goes in htdocs
http://localhost/login.php // directly accessible - goes in htdocs
http://localhost/register.php // directly accessible - goes in htdocs
http://localhost/util.php // you don't want people loading this file directly - put in 'inc'
http://localhost/database_functions.php // you don't want people loading this file directly - put in 'inc'
I believe you need to escape the backslashes in your php.ini -- so it should be C:\\myproject\\inc. But as others have pointed out, you won't be able to use a browser to access the PHP files in your include directory, because the web server will not allow access to a directory outside the htdocs tree.

Categories