First, introduction
As long as the allow_url_fopen option is activated in the php.ini file, you can use the HTTP and FTP URL to replace the file name in most functions that require file names as parameters. At the same time, you can use the URL in include (), include_once (), request (), and a request_once () statement. For more information on the protocol supported by PHP, see Appendix J.
Note: To use the URL in PHP 4.0.3 and its later versions, you need to configure PHP with theNenable-URL-FOPEN-WRAPPER parameter. Remote access from the following functions before the Windows version of the PHP version 4.3: include (), include_once (), request (), request_once (), and the ImageCreateFromxxx function in the XLI, the Image Function library extension library.
For example, you can use the following example to open the file on the remote web server, resolve the output data you need, and then use the data in the database, or simply output it to the style matching of the remaining content of your website. .
Example x. Fopen () example
php $ handle = fopen ("/Home/rasmus/file.txt", "r"); $ hand = fopen ("/Home/rasmus/file.gif", "wb"); $ hand = fopen "http://www.example.com/", "r"); $ hand = fopen ("ftp: // user: password@example.com/somefile.txt", "w");?>
Example X. Get the title of a remote file
php $ file = fopen ("http://www.example.com/", "r"); if (! $ file) {echo "
unable to open remote file./n"; exit; } While (! Feof ($ file) {$ line = fgets ($ file, 1024); / * this only works if the title and its tags are on one line * / if (EREGI ("
If you have a link to a user's identity and an FTP server with a user's identity and an FTP server, you can also write to the FTP server. You can only create new files with this method; if you try to overwrite the already existing file, the invoke of the FOPEN () function will fail.
To connect the server with a username other than "Anonymous", you need to indicate the username (even password), such as "ftp: // user: password@ftp.example.com/path/to/file". (If you need basic authentication when accessing remote files via HTTP protocol, you can also use the syntax used.)
Example X. Data Storage of Remote Services
PHP $ file = fopen ("ftp://ftp.example.com/incoming/outputfile", "w"); if (! $ file) {echo
unable to open remote file for Writing./ n "; exit;} / * Write the data here. * / fputs ($ file, $ _server ['http_user_agent']." / n "); fclose ($ file);?> Note: You may be from the above example Release inspiration, use this technology to store remote log files. However, as mentioned above, in the URL that is opened in a FOPEN (), you can only write a new file. If the remote file already has a fopen () function will fail. To perform a similar distributed log operation, you can refer to the Syslog () function.
In the following content, I will describe the application of this function with more examples.
2. Application of Post & GET in PHP
To use the POST & GET of PHP, you can use the fsockopen function:
Example 1. Fsockopen () Example
PHP $ fp = fsockopen ("www.example.com", 80, $ errno, $ errstr, 30); if (! $ fp) {echo "$ Errstr ($ Errno)
/ n"; } else {$ out = "get / http / 1.1 / r / n"; $ out. = "Host: eXample.com/r/N"; $ out. = "Connection: Close / R / N / R / N "
FPUTS ($ fp, $ out); while (! Feof ($ fp)) {echo fgets ($ fp, 128);} fclose ($ fp);}?>
Example 2. USING UDP Connection
PHP $ fp = fsockopen ("udp: //127.0.0.1", $ errno, $ errstr); if (! $ fp) {echo "error: $ Errno - $ Errstr
/ n" Else {FWRITE ($ FP, "/ N"); Echo Fread ($ fp, 26); fclose ($ fp);}?>
Example 3
PHP
/ / Define some connection parameters $ URLS = array ('host' => 'localhost', 'port' => 80, 'Path' => '/ index.php', 'Method' => 'POST', 'Protocol '=>' 1.0 ',);
// PST method passed the parameter $ ps = array ('language' => 'php', 'Linux' => 'redhat',);
// GET method delivery parameter $ GS = array ('php' => 5, 'redhat' => 9);
/ ** Back: String (String) Parameters returned after POST or GET method: $ USLS: String $ PS: Array $ GS: Array Call Method: GetData ($ URLS, $ PS, '') // Using POST Method GETDATA ($ URLS, '', $ GS) // Using GET Method Reference: http://cn.php.net/manual/en/function.fsockOpen.php * / Function GetData ($ URLS, $ PS = '', $ gs = '') {$ host = $ urls ['Host']; $ port = $ urls ['port']; $ path = $ urls ['Path']; $ method = $ urls [' Method ']; $ protocol = $ urls [' protocol ']; $ posts ='; $ gets = '; if (is_ARRAY ($ PS)) {Foreach ($ PS AS $ K => $ V) {$ POSTS. = Urlencode ($ K). "=". Urlencode ($ V). '&';} $ posts = Substr ($ pos, 0, -1); $ LEN = Strlen ($ pos);} if IS_ARRAY ($ GS) ($ GS AS $ K => $ V) {$ gets. = Urlencode ($ K). "=". Urlencode ($ V). '&';} $ gets = SUBSTR $ gets, 0, -1);}
$ fp = fsockopen ($ Host, $ Port, $ Errno, $ Errstr, 3); if (! $ fp) {echo "can't connect ... / r / n
Error: $ Errstr"; Return FPUTS ($ FP, "$ Method $ PATH? $ Gets http / $ protocol / r / n"); FPUTS ($ FP, "Host: LocalHost / R / N"); if ($ posts! = '' ) {FPUTS ($ FP, "Content-Type: Application / X-WWW-FORM-URLENCODED / R / N"); FPUTS ($ FP, "Content-Length: $ LEN / R / N"); FPUTS ($ FP, "/ r / n"); FPUTS ($ FP, $ Posts);} fputs ($ FP, "Connection: Close / R / N / R / N"); $ s = ''; do {$ Data = FGETS ($ FP, 1024); if ($ DATA == ') {Break;} $ s. = $ data;} while; fclose ($ fp); return $ s;}
/ / Here is the string Echo getData ($ URLS, $ PS, ') returned using the POST method; // If you want to use the get method: echo getdata ($ URLS,' ', $ GS );?>
Third, Unicode Vulnerability Attack
Code: PHP $ fp = @ FOPEN ($ URL, "R") or Die ("Cannot Open $ URL"); while ($ line = @ fgets ($ fp, 1024)) {$ contents. = $ LINE } echo $ contents; // Display file content fclose ($ fp); // turn off file?>
use:
/ Xxxx.php?url=http://target/script/..