Shulou(Shulou.com)06/01 Report--

Program developers usually write reusable functions to a single file, and when using some functions, they call this file directly without having to write it again. this process of calling the file is generally referred to as including. Program developers want the code to be more flexible, so they usually set the included file as a variable for dynamic calls, but it is because of this flexibility that the client can invoke a malicious file. resulting in file inclusion vulnerabilities.

Four file-contained functions are provided in PHP, namely include (), include_once (), require (), and require_once (). The differences between them are as follows:

When require cannot find the included file, it generates a fatal error and stops the script from running.

Include will only generate a warning when it cannot find the included file, and the script will continue to run.

Include_once is similar to include, except that if the code in the file is already included, it will not be included again.

Require_once is similar to require, except that if the code in the file is already included, it will not be included again.

For example, let's look at the following example. 01.txt is a normal text file, but the content of the file is code that conforms to the PHP syntax:

Include 01.txt in the 02.php file as follows:

Put both files in the D:\ AppServ\ www directory, and then visit 02.php in the browser, and you can see that the code in 01.txt has been executed correctly. Next, change the extension of the 02.txt file to jpg, rar, doc, xxx for testing, and found that the phpinfo information can be displayed correctly. Thus, as long as the content of the file conforms to the PHP syntax specification, any extension can be parsed by PHP.

Let's create another test file, 03.txt, whose content is "Hello,world!" and does not conform to the PHP syntax specification. We can find that this kind of file can display its contents directly.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.