include() Why should I not use it?

Question

I am working through an older php mysql book written in 2003. The author uses the include() function to construct html pages by including header.inc, footer.inc, main.inc files, etc. Now I find out that this is not allowed in the default ini settings, (allow_url_include is set to Off) after I got many warnings from the server.

I noticed also that you can use include without the parenthesis. I tried this and it works and I get no error messages or warnings. Are the two different? That is, is include() different from include ?

Answer 1

This is a misunderstanding. You can turn off the inclusion of remote files (using a URL http://www.example.com/include.php instead of a filesystem path). You can always include local files.

The latter is because include is not a normal function, but a language construct. Like die, it can be used with or without parentheses. Source: Manual

Because include() is a special language construct, parentheses are not needed around its argument. Take care when comparing return value.

Answer 2

The use of include() can introduce a Local File Include (LFI) or Remote File Include(RFI) Vulnerably. You should try and avoid using include, for instance if you are including HTML its better to write print(file_get_contents($file)) than include($file). However include()'ing PHP files is necessary in most php applications to reduce code duplication.

Even when remote file inclusion is disabled its still possilbe to exploit the system using an Advanced LFI Attack.

If you do need to accept user input in an include(), then you should make sure its on a white list:

$good_includes=array("contact","home","view");
if(in_array($_GET[page],$good_includes)){
    include("inc/".$_GET[page].".php");
}

Answer 3

There's a major difference with include/require_once and require.

The primary difference is the error reporting, if you use include in your application PHP will attempt to load the file but if it does not exist, it will throw non fatal error (meaning you script will not halt), if you are using require then the script will halt and stop processing.

Use require on files that are fundamental to your application and use include in your templates because if there is an error you can specify not to show the error and thus the user will not know the difference as long as its not a primary template include such as header.php

these functions are mainly used on your own server to include files that are relevant to your application.

if you are including files from outside your server then I would use curl if it's installed or file_get_contents().

Hope this helps you.

just a note on require vs require_once, require_once will add logic to make sure that file is not included more than once, ie you don't want to declare your database connection more than once

Answer 4

Function include is good for dynamic inckuding of files. If we include files in cycle, this very good. But if we include files staticly, we should use require. Second function do in the beginnig of script.