# Simple PHP question
**URL:** https://boards.straightdope.com/t/simple-php-question/322391
**Category:** Factual Questions
**Created:** [September 19, 2005, 6:04pm UTC](https://boards.straightdope.com/t/simple-php-question/322391 "2005-09-19T18:04:55Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@pulykamell](https://boards.straightdope.com/u/pulykamell)
#### Post date: [September 19, 2005, 6:04pm UTC](https://boards.straightdope.com/t/simple-php-question/322391/1 "2005-09-19T18:04:55Z")
OK. I have a Flash programmer I’m working with who is having some difficulty implementing PHP on my web site. The server I use is PHP capable.
Here’s the bit of code:
```auto
```
It is to be implemented in the following format:
[ ](https://www.peterpawinski.com/gallery/fs.php?filename=x.jpg)
What it should return is the following (where ‘meret’ means ‘size’)
> [@](#):
>
> meret=127747&ended=igen
However, all I get is:
> [@](#):
>
> meret=&ended=igen
We’ve tried this script on his server, and it works fine. [http://www.galaktikaszakkor.hu/pawinski/fs.php?filename=x.jpg](http://www.galaktikaszakkor.hu/pawinski/fs.php?filename=x.jpg)
If I make the simple PHP file such as:
```auto
```
it does output both the filename and the filesize correctly, indicating that PHP is working on my server.
What are we doing wrong? Is something not configured correctly? The directory structure of my site is: root \> html \> gallery. The x.jpg file is in the gallery directory.
---
### Author:  [@pulykamell](https://boards.straightdope.com/u/pulykamell)
#### Post date: [September 19, 2005, 6:08pm UTC](https://boards.straightdope.com/t/simple-php-question/322391/2 "2005-09-19T18:08:29Z")
Here’s the result of phpinfo()
[http://www.peterpawinski.com/test1.php](http://www.peterpawinski.com/test1.php)
This is a bunch of gibberish to me, but I suspect the problem may line in the configuration?
---
### Author:  [@leandroc76](https://boards.straightdope.com/u/leandroc76)
#### Post date: [September 19, 2005, 6:16pm UTC](https://boards.straightdope.com/t/simple-php-question/322391/3 "2005-09-19T18:16:30Z")
\
---
### Author:  [@Erinaceus\_europaeus](https://boards.straightdope.com/u/Erinaceus_europaeus)
#### Post date: [September 19, 2005, 6:22pm UTC](https://boards.straightdope.com/t/simple-php-question/322391/4 "2005-09-19T18:22:22Z")
At a guess, $filename doesn’t point to an existing or accessible file. Print out $filename to see what it contains, and check the file/directory permissions.
---
### Author:  [@pulykamell](https://boards.straightdope.com/u/pulykamell)
#### Post date: [September 19, 2005, 6:24pm UTC](https://boards.straightdope.com/t/simple-php-question/322391/5 "2005-09-19T18:24:20Z")
> [@leandroc76](#):
>
> \
> $filename = ‘/gallery/x.jpg’;
> echo $filename . ‘: ’ . filesize($filename) . ’ bytes’;
>
> ?\>
No, you misunderstand. That works. Or at least $filename=“x.jpg” works.
What I need is for this:
[ ](https://www.peterpawinski.com/gallery/fs.php?filename=x.jpg)
to work. I need external queries (I’m guessing this is what they’re called) to work.
---
### Author:  [@pulykamell](https://boards.straightdope.com/u/pulykamell)
#### Post date: [September 19, 2005, 6:27pm UTC](https://boards.straightdope.com/t/simple-php-question/322391/6 "2005-09-19T18:27:18Z")
> [@Erinaceus europaeus](#):
>
> At a guess, $filename doesn’t point to an existing or accessible file. Print out $filename to see what it contains, and check the file/directory permissions.
I don’t do PHP code, but deducing the format of PHP code, I uploaded this:
```auto
```
I tried accessing it with [http://www.peterpawinski.com/gallery/fs2.php?filename=x.jpg](http://www.peterpawinski.com/gallery/fs2.php?filename=x.jpg)
This should just echo the filename variable back to me, right? I just get a blank.
---
### Author:  [@JeffyDMan](https://boards.straightdope.com/u/JeffyDMan)
#### Post date: [September 19, 2005, 6:38pm UTC](https://boards.straightdope.com/t/simple-php-question/322391/7 "2005-09-19T18:38:50Z")
Actually…
```auto
```
But we have to know where it’s getting the $filename variable from…
I don’t know i your developer is willing, but can you copy/paste the content of said script to [www.pastebin.com](http://www.pastebin.com) and either post the URL here or even, if the script is ENORMOUS, post the content of the script here…
It’s impossible to debug from snippets of code for the most part.
---
### Author:  [@pulykamell](https://boards.straightdope.com/u/pulykamell)
#### Post date: [September 19, 2005, 6:41pm UTC](https://boards.straightdope.com/t/simple-php-question/322391/8 "2005-09-19T18:41:50Z")
> [@JeffyDMan](#):
>
> Actually…
>
> ```auto
>
>
> print $filename;
>
> ?>
>
> ```
>
> But we have to know where it’s getting the $filename variable from…
>
> I don’t know i your developer is willing, but can you copy/paste the content of said script to [www.pastebin.com](http://www.pastebin.com) and either post the URL here or even, if the script is ENORMOUS, post the content of the script here…
>
> It’s impossible to debug from snippets of code for the most part.
That IS the entire code for the test file.
I can’t seem to be able to pass variables. That seems to be the problem.
---
### Author:  [@Walton\_Firm](https://boards.straightdope.com/u/Walton_Firm)
#### Post date: [September 19, 2005, 6:42pm UTC](https://boards.straightdope.com/t/simple-php-question/322391/9 "2005-09-19T18:42:59Z")
What you are trying to do, only works when **register\_globals** is on. According to your phpinfo(), it’s off. It should be, because register\_globals opens up entire categories of security problems.
With register\_globals off, you can access the variables from the GET request like this: $\_GET[‘filename’] .
On your own server, register\_globals is apparently enabled. You should turn it off ASAP, if at all possible, unless you are **very** certain that all of your PHP applications have been very carefully written to correctly deal with implicit globals.
Here’s some info:
[http://www.php.net/manual/en/security.globals.php](http://www.php.net/manual/en/security.globals.php)
---
### Author:  [@JeffyDMan](https://boards.straightdope.com/u/JeffyDMan)
#### Post date: [September 19, 2005, 6:44pm UTC](https://boards.straightdope.com/t/simple-php-question/322391/10 "2005-09-19T18:44:14Z")
Ah, well then, change it to this:
filesize($\_GET[‘filename’])
That’ll bypass the need for register\_globals, which is bad juju anyway.
---
### Author:  [@Erinaceus\_europaeus](https://boards.straightdope.com/u/Erinaceus_europaeus)
#### Post date: [September 19, 2005, 6:44pm UTC](https://boards.straightdope.com/t/simple-php-question/322391/11 "2005-09-19T18:44:42Z")
> [@pulykamell](#):
>
> This should just echo the filename variable back to me, right? I just get a blank.
If the code in the OP is all the code, you should note that because of security issues, newer PHP installations don’t automatically create variables from query parameters by default (i.e. page.php?stuff=value does not create a $stuff variable)
You’d need something like
```auto
$filename = $_GET['filename']
```
to set the $filename variable and proceed from there.
---
### Author:  [@Walton\_Firm](https://boards.straightdope.com/u/Walton_Firm)
#### Post date: [September 19, 2005, 6:45pm UTC](https://boards.straightdope.com/t/simple-php-question/322391/12 "2005-09-19T18:45:55Z")
By the way, speaking about security, allowing callers to supply filenames to your PHP script through GET request is another very, very bad practice. Now, as long as _filesize_ is the only function you call on it, the risks shouldn’t be too great, but as soon as you do more than that you’d better check your input very, very carefully.
---
### Author:  [@Erinaceus\_europaeus](https://boards.straightdope.com/u/Erinaceus_europaeus)
#### Post date: [September 19, 2005, 6:47pm UTC](https://boards.straightdope.com/t/simple-php-question/322391/13 "2005-09-19T18:47:09Z")
and **JeffyDMan** beat me to it 🙂
---
### Author:  [@Walton\_Firm](https://boards.straightdope.com/u/Walton_Firm)
#### Post date: [September 19, 2005, 6:50pm UTC](https://boards.straightdope.com/t/simple-php-question/322391/14 "2005-09-19T18:50:35Z")
> [@Erinaceus europaeus](#):
>
> and **JeffyDMan** beat me to it 🙂
Hey! What am I, chopped liver? 😛
---
### Author:  [@Erinaceus\_europaeus](https://boards.straightdope.com/u/Erinaceus_europaeus)
#### Post date: [September 19, 2005, 6:52pm UTC](https://boards.straightdope.com/t/simple-php-question/322391/15 "2005-09-19T18:52:55Z")
> [@Walton Firm](#):
>
> Hey! What am I, chopped liver? 😛
I don’t know, are you? 🙂
Sorry, I didn’t spot your reply.
---
### Author:  [@pulykamell](https://boards.straightdope.com/u/pulykamell)
#### Post date: [September 19, 2005, 7:07pm UTC](https://boards.straightdope.com/t/simple-php-question/322391/16 "2005-09-19T19:07:01Z")
> [@Walton Firm](#):
>
> By the way, speaking about security, allowing callers to supply filenames to your PHP script through GET request is another very, very bad practice. Now, as long as _filesize_ is the only function you call on it, the risks shouldn’t be too great, but as soon as you do more than that you’d better check your input very, very carefully.
OK. That’s all that this script will be used for, so far as I know.
So, please spell this out for me.
What’s the complete correct code so that the original script
> [@](#):
>
> \ echo ‘meret=’.filesize($filename) . “&ended=igen”;
> ?\>
echoes the filesize of the file x.jpg when the following request is made:
…/gallery/fs.php?x.jpg
Or what if I were to turn global\_registers on. Is this a really bad idea? Even if it is, how would I do so? Where do I find the php.ini file, and how do I access it?
---
### Author:  [@JeffyDMan](https://boards.straightdope.com/u/JeffyDMan)
#### Post date: [September 19, 2005, 7:07pm UTC](https://boards.straightdope.com/t/simple-php-question/322391/17 "2005-09-19T19:07:36Z")
> [@Walton Firm](#):
>
> By the way, speaking about security, allowing callers to supply filenames to your PHP script through GET request is another very, very bad practice. Now, as long as _filesize_ is the only function you call on it, the risks shouldn’t be too great, but as soon as you do more than that you’d better check your input very, very carefully.
Correct!
It’s always best to do one of the following things for security;
Set a fixed folder where files will go, make sure the script won’t look outside of that folder.
IE:
/images/photos \> Make sure it can never look outside of the /images/photos folder (make sure people can’t issue …/… or ./, etc.
Have a script go through and create an index of all the available files and put those into an array, make sure the script only uses the array of available images for that information - you can even **hide** the filename by referencing it with the array key.
IE:
$imgarray = array(“abc123.jpg”, “xyz321”);
Someone asks for the first image, they would see this in the url:
?image=0 (the script would then return the first image, abc123.jpg).
Many things you can do to make your scripts highly secure, and they require very little effort either way.
---
### Author:  [@pulykamell](https://boards.straightdope.com/u/pulykamell)
#### Post date: [September 19, 2005, 7:08pm UTC](https://boards.straightdope.com/t/simple-php-question/322391/18 "2005-09-19T19:08:54Z")
> [@pulykamell](#):
>
> …/gallery/fs.php?x.jpg
>
> Or what if I were to turn global\_registers on. Is this a really bad idea? Even if it is, how would I do so? Where do I find the php.ini file, and how do I access it?
sorry. should read:
…/gallery/fs.php?filename=x.jpg
---
### Author:  [@pulykamell](https://boards.straightdope.com/u/pulykamell)
#### Post date: [September 19, 2005, 7:13pm UTC](https://boards.straightdope.com/t/simple-php-question/322391/19 "2005-09-19T19:13:24Z")
Basically, to clarify, this is what’s going on (so far as I know):
My Flash programmer from Hungary needed to use PHP to check file sizes, in order to create progress bars for loading images. Simple enough. The code worked on his website, but not on mine. I suppose he must have an older version of PHP which defaults to register\_globals on. So, as the web site runs now, the progress bars are useless and don’t tell you any correct information.
Notice the difference between how the progress bars on the bottom of the picture work here:
[http://www.galaktikaszakkor.hu/pawinski](http://www.galaktikaszakkor.hu/pawinski)
and how they work here:
[http://www.peterpawinski.com/gallery](http://www.peterpawinski.com/gallery)
The exact same code is used in both.
p
---
### Author:  [@Walton\_Firm](https://boards.straightdope.com/u/Walton_Firm)
#### Post date: [September 19, 2005, 7:16pm UTC](https://boards.straightdope.com/t/simple-php-question/322391/20 "2005-09-19T19:16:47Z")
On a UNIX-like machine (e.g. FreeBSD or Linux), the php.ini file is typically located in the /etc directory. On Windows, I believe it’s usually \Windows\System32. Also, depending on your Apache setup, placing a php.ini file in the root directory of your webserver’s content directory (e.g. /var/www or C:\inetinfo\wwwroot) may also work.
Either way, the following script should work no matter what register\_globals is set to:
```auto
```
[Next page](https://boards.straightdope.com/t/simple-php-question/322391.md?page=2)