How can I access a script out of root by http protocol?

Question

I have this folder-structure:

\out
    \script.php
\root
    \include
        \calculator.php

I need that script into \calculator.php. How can I include it?

// calculator.php
require( what path ? );
 ..

Note: I can include it by this path: ../out/script.php. But I also need to pass a argument to script.php. So I want something like this:

.. what path/script.php?arg=value

And as you know, because I need to pass a argument to that, so I have to use http protocol. All I want to know, How can I use both http and ../? Something like this:

http://../out/script.php?arg=value

No you can't access anything outside of root and its subfolders through a webbrower; although you can configure an alias in the web server that would allow you to access other folders — Mark Baker, Apr 28 '16 at 00:00
@MarkBaker Actually I can access something outside of root like this `../out/script.php`. But I don't know how can I both *pass a argument* and use `../` — stack, Apr 28 '16 at 00:02
Technically one could include a local script after overriding the request parameters. *Seldomly advisable.* — mario, Apr 28 '16 at 00:03
Your webserver should prevent you from accessing anything outside of root and its subfolders through a webbrowser.... otherwise Joe Hacker would be able to access any files on the server including password files, and that would be a serious security flaw that would destroy the www completely — Mark Baker, Apr 28 '16 at 00:04
@MarkBaker Look, I have fallowed [this](http://stackoverflow.com/questions/36847008/how-can-i-limit-accessing-my-websites-scripts-for-others) approach. Is that bad? — stack, Apr 28 '16 at 00:10
@stack the link you followed says to use `../` in the script not in the browser — Nishanth Matha, Apr 28 '16 at 00:13
@NishanthMatha Yes .. I need to use `../` in the script. *(I never want to access anything by browser)*. But because I also need to pass an argument, then I need to write `http` protocol. So how can I use both `http` protocol and `../` in script? — stack, Apr 28 '16 at 00:15
if you need to pass an argument to the script follow this standard: http://stackoverflow.com/questions/1232097/php-include-a-php-file-and-also-send-query-parameters You need not use `http` for it — Nishanth Matha, Apr 28 '16 at 00:23

Ryan Jenkin · Answer 1 · 2016-04-28T00:05:39.717

1

You don't need to pass parameters when you include the script because it's loaded into the same scope as the first script. This means that the script ../out/script.php has access to the query string arguments through the $_GET variable:

$_GET['arg']

Also, any variables you define in calculator will be available in script.php

edited Apr 28 '16 at 00:05

answered Apr 28 '16 at 00:04

Ryan Jenkin

864
8
11

score 1 · Answer 2 · answered Apr 28 '16 at 00:07

You could instantiate some variables inside the $_GET superglobal before you include your file, i.e.

$_GET['arg'] = "value";
require('../../out/script.php');

But that isn't ideal, in my opinion.

If I were you I'd use a boring 'ol global variable (assuming you start in the global scope):

$arg = 'value';
require('../../out/script.php');

Then simply use it like any other variable (maybe with some sanity checking, though):

if (!isset($arg)) {
    die('Oh my! $arg is not set! Error! Danger!');
}

do_something_with($arg);

How can I access a script out of root by http protocol?

2 Answers2

Linked