need help with php code

[itmees]

need a bit help with php.

i have a script that gets info from file and displays it on site, however when file contains php script, then site will run it, and thats bad bcos security

php code to get file:
<?php include("./files/".$_GET["ID"].".file"); ?>

is there any way to disable php from running and displaying only file content, so it would ignore php tags in content. however it should allow html tags

cheers

itmees Reviewed by itmees on 21st Mar 2012. need help with php code need a bit help with php. i have a script that gets info from file and displays it on site, however when file contains php script, then site will run it, and thats bad bcos security php code to get file: <?php include("./files/".$_GET.".file"); ?> is there any way to disable php from running and displaying only file content, so it would ignore php tags in content. however it should allow html tags cheers :) Rating: 5

[Apathetic]

file_get_contents? cURL?

The particular use of include() is to include php files so would be able to run them as part of your code.

[itmees]

darn i should have taken that php course

edit: gonna contact script creator, he probably has ideas

[Apathetic]

^HTML can't be "parsed" in inputs.

[Gavo]

This site is using a hacked database of W junction

[JamesVaporH]

You want to display a php file without it being parsed?

You can use htaccess to turn off php parsing in a directory
http://www.electrictoolbox.com/disab...ache-htaccess/

Hes looking to still include the page which means he will need php to still parse..'

You will need to use a combination of file_read_contents and have it read only.. If you allow it to write people can write shell files.

[mRAza]

if you wants to display html from a file and not execte php code from that file then you can use fopen, here is a small example.

    $file =  "location/file.php";
    $f = fopen($file, "r");
        while ( $line = fgets($f, 1000) ) {
        print $line;
        } 

and if you wants to display php with colors highlighting code u can use highlight_file function which will display php code without executing it and remember it will not parse html code.