1

I just noticed a PHP config parameter called allow_url_include, which allows you to include a PHP file hosted elsewhere as you would a locally. This seems like a bad idea, but "why is this bad" is too easy a question.

So, my question: When would this actually be a good option? When it would actually be the best solution to some problem?

4 Answers 4

3

Contrary to the other responders here, I'm going to go with "No". I can't think of any situation where this would make a good idea.

Some quick responses to the other ideas:

  • Licensing : would be very easy to circumvent
  • Single library for multiple servers: I'm sorry but this is a very dumb solution to something that should be solved by syncing files from for example a
    • sourcecontrol system
    • packaging / distribution system
    • build system
    • or a remote filesystem. NFS was mentioned
  • Remote library from google: nobody has a benefit to a slow non-caching PHP library loading over PHP. This is not (asynchronous) javascript

I think I covered all of them..

Now..

your question was about 'including a file hosted elsewhere', which I think you should never attempt. However, there are uses for allow_url_include. This setting covers more than just http://. It also covers user-defined protocol handlers, and I believe even phar://. For these there a quite a bit of valid uses.

2

The only things I can think of are:

  1. for a remote library, for example the google api's.
  2. Alternately, if you are something like facebook, with devs in different locations, and the devs use includes from different stage servers (DB, dev, staging, production).
  3. Once again during dev, to a third party program that is in lots of beta transition, so you always get the most recent build without having to compile yourself (for example, using a remote tinymce beta that you are going to be building against that will be done before you reach production).

However, if the remote server goes down, it kills the app, so for most people, not a good idea for production usage.

2

Here is one example that I can think of.

At my organization my division is responsible for both the intranet and internet site. Because we are using two different servers and in our case two different subdomains then I could see a case for having a single library that is used by both servers. This would allow both servers to use the same class. This wouldn't be a security problem because you have complete control over both servers and would be better than trying to maintain two versions of the same class.

Since you have control over the servers, and because having an external facing server and internal server requires seperation (because of the firewall) then, this would be a better solution than trying to keep a copy of the same class in two locations.

0
1

Hmm...

[insert barrel scraping noise here]

...you could use this is a means of licensing software - in that the license key, etc. could be stored on the remote system (managed by the seller). By doing this, the seller would retain control of all the systems attempting to access the key.

However, as you say the list of reasons this is a horrifying idea outweigh any positives in my mind.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.