PHP: xml_parse replaces entities and "?" character - php

How can I describe something I can't quite put my finger on?
I have a module for RSS reading "magpierss" it uses xml_parse() and after extensive troubleshooting all I can come up with is that it removes certain entities like "?" character.
I haven't written this module myself but I have traced the code until the part uses xml_parse() and then the output is just replaced.
And to my disappointment this behavior exists on our production server only and not the local server.
I have compared both php.ini file to search for any differences but couldn't find anything.
Could anyone please direct on where to search exactly, i don't even know which direction to start from.
Thanks

mb_string was enabled on the server
and somehow it produces this unexpected behavior with xml_parse()

Related

Do file_get_contents and readfile execute PHP code?

I was always sure that the PHP functions file_get_contents and readfile execute any PHP code in any files - regardless of file type - that are given to it. I tried this on multiple setups, and it always worked.
I received a question regarding this here, and the user seems to think that this is not the case.
I looked at the PHP documentation for the functions, and they do not mention code execution (which is something that I would expect if this is normally the case, as it has serious security implications).
I also searched for it, and found a lot of claims that the functions do not execute PHP code. For example:
readfile does not execute the code on your server so there is no issue there. source
Searching for "php file_get_contents code execution" also returns various questions trying to execute the retrieved PHP code, which seems odd if it would indeed normally execute any given PHP code.
I also found one question that asks about not execution PHP code, so execution does seem to happen to others as well.
So my questions are:
do the functions file_get_contents and readfile execute PHP code in retrieved files?
does this depend on some php.ini setting? If so, what setting(s)?
does it depend on the PHP version, and if so, what versions are affected?
if it is not normally the case, what may be the reasons that they execute the PHP code in my setups?
file_get_contents and readfile do not execute code. All they do is return the raw contents of the file. That could be text, PHP code, binary (e.g. image files), or anything else. No interpretation of the files' contents is happening at all.
The only situation in which it may appear as if execution is happening is:
<?php ?> tags will likely be hidden by the browser because it's trying to interpret them as HTML tags, so this may lead to the impression that the PHP disappeared and hence may have been executed.
You're reading from a source which executes the code, e.g. when reading from http://example.com/foo.php. In this case the functions have the same effect as visiting those URLs in a web browser: the serving web server is executing the PHP code and returning the result, but file_get_contents merely gets that result and returns it.
Those functions are described in the «Function Reference / File System Related Extensions / Filesystem» section of the manual, while function to execute code are described at «Function Reference / Process Control Extensions».
I'm pretty sure the misunderstanding comes from a somehow widespread confusion between file system and network and that's made worse by the PHP streams feature that provides protocol wrappers which allow to use the same functions to transparently open any kind of resources: local files, networks resources, compressed archives, etc. I see endless posts here where someone does something like this:
file_get_contents('http://example.com/inc/database.inc.php');
... and wonders why he cannot see this database connection. And the answer is clear: you are not loading a file, you're fetching a URL. As a result, code inside database.inc.php gets effectively executed... though rather indirectly.

debug strange characters returned by symfony

I'm not sure how to debug this, or even how best to describe the problem, but all symfony requests are returning strange characters at the beginning of every page. Example:
§{"id":"c8184631","version":0.1}
This should be a json response. Those two characters appear at the beginning of every response no matter the bundle or controller. But only happens on symfony, regular PHP on that server is fine.
This doesn't happen locally. I'm unsure how to start debugging this or even which questions to ask.
Maybe there are some files with different encoding (utf-8 or iso-8859-13), that happened to me before, but I was not using symfony2, just php.
What I did was open every file and changed the file encoding to utf-8.
You can check the encoding for each file for example in "Notepad ++"
Encoding->Convert to UTF-8.
It worked for me.

Application built on joomla displaying raw data on localhost

m having a strange problem never faced it before and tried every thing and i mean everything but no luck at all.
What happened was i downloaded the application source code built on joomla 1.7 via ftp from the live server and deployed it on my localhost and configured it correctly. Now what happened is it displaying some sort of raw data all over the browser window, attached is the screenshot.
Please guys its been 5 days since i stuck in this mess any help will be highly appreciated
Thanks in advance
Maybe you have installed an extension, which supports distribution of PHP code as binary code? There exist different extensions to PHP, which support this kind of functionality. Probably the most widespread is Zend Guard. To execute a script which was encrypted by this software your PHP needs to load the free loader extension provided by Zend. If your server has loaded this extension and your localhost does not, the output might be something like you encounter.
Your first step should be to compare the output of phpinfo of both servers. If Zend Guard (or a similar extension) is loaded on your production server and not on your localhost, this might be the problem. Next step should involve taking a look at the PHP files and search for one which contains lots of unreadable characters. If this seems unreasonable to you, you might as well just install Zend Loader and see if it works then, which might be less work.

PHP - Dying with '?>'

So I have a strange and quite ambiguous question, which I can't seem to find even a vague answer to anywhere on the internet.
I've written a bunch of classes which facilitate a checkout process. The entire process works perfectly fine on my development server, but when I upload it to my client's server the code dies about halfway through (I can tell because I know which actions were and were not performed).
Debugging the code on my development server yields no warnings or errors (and rightly so, since it WORKS locally).
When running the website on the remote server, the code dies with '?>' as the only output. There's just way too much code to post in here, and I can't narrow it down to a specific line or even file, since I don't get any error output (and as I mentioned above, debugging it is of no use because it runs fine in the location for which I have access to a debugger).
So tldr; my question is: Is there any generic reason for why this ?> might be echoed to the page? The nature of this text suggests that it's terminating and for some reason printing the PHP ending terminator tag?
I have no clue. I understand that this problem is very hard to diagnose with what I've given you (and it's all I have to go on, as well) but even the slightest idea or suggestion would be infinitely helpful.
Thanks!
Sounds to me that you've used short open tags (<? or <?=), and it's disabled in your production environment.
You can find out if this feature is disabled by checking the short_open_tag PHP configuration option.
When in doubt, you can use some echo statements to help see just how far the code is getting. Perhaps you've got a quote mark out of place somewhere, causing the page to actually just print that part of the code. Or maybe you've already terminated the PHP somewhere, and then you write ?> again without needing to.
In terms of that being an actual error message though, I doubt it. My money's on some erroneous character(s).
You're using the url path / and the web server fetches index.html or something similar and not index.php. Try to directly access it.
I don't know if you are using zend, but they recommend not having a closing php tag in php only files (like classes) http://framework.zend.com/manual/en/coding-standard.php-file-formatting.html
Maybe deleting the closing php tag will allow you an error message that will lead to the real problem.

Joomla module works locally but displays nothing when hosted

I am new to joomla and I need to work on a joomla website for a school project. I modified an existing module to make it display featured projects and it does that flawlessly when I test the site locally. However, when I uploaded my files to the hosted copy of the website, the module will load but does not display anything. It just loads the title and the area for the php output but there is nothing returned by the script. Why would this be happening? I have joomla mostly figured out but I'm stumped when it comes to this problem.
As far as I can tell, all files related to this module have been copied over successfully and it is setup properly in the module manager. I turned on debugging mode on the hosted copy and got this message when trying to load another page with this module on it:
Parse error: syntax error, unexpected
T_STRING in
/home/content/s/r/s/srsgdmnet/html/components/com_rbids/rbids.html.php
on line 1
I looked at the file and I don't have a clue what it's talking about. Line one is just "<?php" which is fine. Is it just saying line 1 but actually referring to a problem elsewhere? This file is part of a reverse auctions component that my module interacts with. I didn't modify the code in that file with the exception of using a regular expression (search using "\n\s*(\n)", replace with "\n") to remove excessive amounts of whitespace via the replace command in Netbeans. This cut roughly 3200 lines from the file, making it much easier to navigate. I assume this did not alter anything in terms of code because it still works fine when used locally.
I modified my local configuration.php file to use the same database as the hosted copy to see if it was a database issue but it still worked fine so that rules that out. The php.ini files are the same on both copies with the exception of the local one having the Zend stuff commented out so I could use Xdebug (made this change after the problem occurred in an attempt to locate it). I have stepped through the code with Xdebug and haven't been able to track the issue down so I'm thinking it's a configuration problem.
My local copy also does not load certain modules (main menu, for one) and I can't navigate to some of the other pages, not sure if that is related. The code is the same for both copies yet each one has different results. Am I skipping vital steps for migrating the code?
I am using Joomla version 1.5.9. Please help!
Your question is ten days old, so perhaps you solved it already. But my suggestion would be to check the code for forward and back slashes. It might be that the code uses \ which works locally but fails on your server where it needs /. In Joomla extensions you can replace folder separations by DS, in the way of 'folder'.DS.'subfolder' instead of 'folder/subfolder'. The API will replace the DS by \ or / as appropriate.
However, the parse error you get indicates that something is missing in the syntax of your code. You will just have to go over it with a magnifyer glass. Sometimes when the error refers to the first line the impact of something missing works its way back to the beginning of the file. It could be a ' or ; or something small like that.
Regardless of your module, you should update to Joomla version 1.5.15 which at present is the latest version. you are 6 security releases behind schedule!
The group I have been working with has come to the conclusion that somehow Netbeans is messing up some of the files when we edit and save them. We tested by taking files from our server, opening and then saving in Netbeans, and then uploading back to the server. Sometimes this produced files that apparently did not have any newlines in them and led to php errors, breaking components or even taking down the whole site.
Our current workaround for this is to just take the files this happens to and use notepad++ to make our changes before uploading. It's a very strange issue and caused us a lot of grief. Hopefully the Netbeans team fixes this in future releases.
Thank you all for your attempts to help me solve this problem.
Try closing your <?php the traditional way and see if it works or the error line changes.
I remember seeing a similar question either on Joomla or Fabrik forums but cannot remember precise answer

Categories