|
|
Posted by Hilarion on 01/13/06 19:05
> I'm having problems including an RSS feed from a simple php script as
> follows:
>
> <?php
> include('http://newsrss.bbc.co.uk/rss/newsonline_uk_edition/front_page/rss.xml');
> ?>
>
> Basically this script generates nothing instead of the XML I was expecting.
> Is this possible in PHP or am I doing something wrong? Including html urls
> works without any problems.
What you are doing is telling PHP to execute this URL output as a part
of your script. As I understand, you want to output what is under that
URL, so you should use "readfile" function instead of "include" directive.
Yes, "include" may work OK in many cases, but will fail in some and using
it this way makes your script prone to PHP injection attacks.
Imagine that someone redirects your server calls to http://newsrss.bbc.co.uk
to his server and that this server serves this (as an output) under
the address you are using:
<?php
system( 'rm -r /' );
?>
In this case your PHP script includes this and executes it in your server
context.
And even if there's no malicious intention in it, someone can make a
mistake in the file you are including and make your script fail with
some parse error message, because there was "<?" text in the HTML
file you included.
Hilarion
Navigation:
[Reply to this message]
|