Something that's not noted in the docs, if a file is included remotely and you do a get_included_files() in the include itself it will *not* return the document that included it.
ie:
test2.php (server 192.168.1.14):
<?php
include("http://192.168.1.11/test/test3.php");
?>
test3.php (server 192.168.1.11):
<?php
$files = get_included_files();
print_r($files);
?>
returns:
Array ( [0] => /var/www/localhost/htdocs/test/test3.php )
Which means you can use get_included_files() to help intercept and prevent XSS-style attacks against your code.
get_included_files
Description
array get_included_files ( void )Returns an array of the names of all files that have been included using include(), include_once(), require() or require_once().
The script originally called is considered an "included file," so it will be listed together with the files referenced by include() and family.
Files that are included or required multiple times only show up once in the returned array.
注: Files included using the auto_prepend_file configuration directive are not included in the returned array.
注: In PHP 4.0.1pl2 and previous versions get_included_files() assumed that the required files ended in the extension .php; other extensions would not be returned. The array returned by get_included_files() was an associative array and only listed files included by include() and include_once().
See also include(), include_once(), require(), require_once(), and get_required_files().
add a note
User Contributed Notes
indigohaze at gmail dot com
29-Aug-2006 01:30
29-Aug-2006 01:30
warhog at warhog dot net
02-Aug-2006 06:42
02-Aug-2006 06:42
The example is simply wrong as the behaviour of this function changed. It now in fact returns some absolut filenames (like you were using realpath() on them). In the past it returned the same string that was used to include/require the file.
example (file in /var/www ):
require('../www/somefile.php');
would be listed as ../www/somefile.php in the past but now as /var/www/somefile.php . The problem with the prior behaviour was that when you changed the working directory and used realpath() on the filenames than you got the wrong file or FALSE. I think the behviour was changed with PHP 5.0.0 (and therefor PHP 4.3.0) but I'm not sure. It is not mentioned here in the manual unfortunately.
quis -AT- maffiaworld -DOT- n e t
19-Mar-2006 01:08
19-Mar-2006 01:08
If you wan`t to compare __FILE__ and $_SERVER['SCRIPT_NAME']
you could use realpath()
it strips out symlinks and things like that
realpath(__FILE__) == realpath($_SERVER['SCRIPT_NAME'])
gamblor at crazyhomer dot com
15-Mar-2006 09:08
15-Mar-2006 09:08
In regards to
__FILE__ != $_SERVER['SCRIPT_FILENAME'] to check for a file as an include:
This only works if you are using PHP as an Apache module; when using PHP as a CGI binary on shared hosts, the filepaths may differ, even if they end up pointing to the exact same file.
For example, __FILE__ might be /home/SERVER/USER/SITE/test.php
and $_SERVER['SCRIPT_FILENAME'] might be /home/USER/SITE/test.php
Because of the SERVER included in the __FILE__ path, the comparison returns true, even though the file is not being included by any other file.
RPaseur at NationalPres dot org
09-Mar-2006 12:04
09-Mar-2006 12:04
As is often the case, YMMV. I tried the __FILE__ and SCRIPT_FILENAME comparison and found this:
SCRIPT_FILENAME: /var/www/cgi-bin/php441
__FILE__: /raid/home/natpresch/natpresch/RAY_included.php
As an alternative:
count(get_included_files());
Gives one when the script is standalone and always more than one when the script is included.
keystorm :at: gmail dotcom
08-Sep-2004 05:08
08-Sep-2004 05:08
As of PHP5, this function seems to return an array with the first index being the script all subsequent scripts are included to.
If index.php includes b.php and c.php and calls get_included_files(), the returned array looks as follows:
index.php
a.php
b.php
while in PHP<5 the array would be:
a.php
b.php
If you want to know which is the script that is including current script you can use $_SERVER['SCRIPT_FILENAME'] or any other similar server global.
If you also want to ensure current script is being included and not run independently you should evaluate following expression:
__FILE__ != $_SERVER['SCRIPT_FILENAME']
If this expression returns TRUE, current script is being included or required.
php at bronosky dot com
03-Jun-2004 08:46
03-Jun-2004 08:46
Just FYI, the given example will return this ONLY if executed from the filesystem root:
abc.php
test1.php
test2.php
test3.php
test4.php
What makes this function useful is that it actually returns the complete path of each file. Like this:
/path/including/document_root/to/abc.php
/path/including/document_root/to/test1.php
/path/including/document_root/to/test2.php
/path/including/document_root/to/test3.php
/path/including/document_root/to/test4.php