Couldn't one, if they knew the names of the variables, find out someone's DB info?

[Dylan B]

Like, if I were to include some's config.php on a remote server, couldn't I then echo $password and whatever?

[vinyl-junkie]

If you have register globals off, it is very unlikely that someone would be able to retrieve password information via a remote server. You might want to have a look at this thread and the prior thread that it links to for some ideas on how to make your scripts more secure. There is also an excellent SitePoint article here on PHP script security.

Hope this helps.

[Dylan B]

But like, lets say on your server, you have a file config.php located at http://www.yourserver.com/config.php

If I were to create a script like:

<?php
include('http://www.yourserver.com/config.php');
echo $password;
?>

and simply guess and check until I got it right, couldn't I be able to get it?

[vinyl-junkie]

To quote a post from that other thread I mentioned:

In a word, no. The only way I know of that they could cause harm would be to run their script on your server. Register globals OFF prevents that from happening.

[Dylan B]

WHat I'm not undersatnding, is why wouldn't that work? If I were to run the above script on my server, wouldn't I eventually get the password?

[amrknt]

But like, lets say on your server, you have a file config.php located at http://www.yourserver.com/config.php

If I were to create a script like:

<?php
include('http://www.yourserver.com/config.php');
echo $password;
?>

and simply guess and check until I got it right, couldn't I be able to get it?

If you want to use variable form a included file, include the file with SERVER PATH instead of URL PATH.

[mwolfe]

I just now tested if you could do that using some very important information i have in an include file for a site i made.. I was not able to get the variables from a remotely included/required page.. It looks like php has secured that. However you can include remote pages without any problems. I suppose that is common knowledge though

[Dylan B]

That you kind sirs

[vinyl-junkie]

That you kind sirs

Erm, I'm not a sir, but you're welcome!

[Dylan B]

Thank**

And Sir and/or Madams**

[dmsuperman]

If you include a file from another server it merely includes the html output, not the PHP source, otherwise PHP wouldn't be very secure would it? :P

[Dylan B]

If you include a file from another server it merely includes the html output, not the PHP source, otherwise PHP wouldn't be very secure would it? :P

But on your own server, you can access varaiables defined in an include