How to call a PHP script from a PHP script on another server

views:

answers:

+2 Q:

How to call a PHP script from a PHP script on another server

Hello,

I have access to two distinct servers. I would like one's PHP script to call a URL on the other's server (and pass a secret variable). However, I want to make sure nobody else can spoof this call.

What is the best way to do this, short of SSL? I was thinking about hashing but anyone can read the POST request's hash and spoof it.

Thanks!

I'm not sure that is possible at all. If the PHP-Script of ServerA calls the script on ServerB, that script will be interpreted by ServerB, it generates an output HTML/Whatever and gives that output to the script of ServerA.

AFAIK it's not possible to access a PHP-Script before it is interpreted, as long as you don't have direct FTP-Access on it.

ApoY2k 2010-07-21 06:02:35

+2 A:

Maybe you need SSH. You call the other script through ssh, which means no one else can see what's going on. See this blog

jao 2010-07-21 06:04:24

Sweet! This is great way.

Jasie 2010-07-21 07:13:47

+1 Very nice, very nice indeed.

George Marian 2010-07-21 07:37:37

What about using cURL and a SSL connection?

George Marian 2010-07-21 06:05:52

The OP asked what was the best way to do this, short of using SSL.

NullUserException 2010-07-21 06:07:53

@null Oh damn, nevermind. Dunno how I missed that. =/

George Marian 2010-07-21 06:09:58

+2 A:

There are many ways to do this

If your servers have static ip's, you could check the IP address. (If you are on shared hosting other people on the server will have the same IP)
You can encrypt the data with AES and decrypt it on the other end. Of course you'd have to encode this (using base64_encode, for example) before POST'ing it.

NullUserException 2010-07-21 06:06:20

Ah yes, encryption. A good solution.

Jasie 2010-07-21 07:15:08

Your best bet is to employ some kind of encryption to encrypt the variable. RSA is a secure, common one that has examples ready to copy/paste in php. It might be a bit hard to wrap your head around, but once you get it working, it is extremely secure.

Honestly your easiest way is SSL encryption.

contagious 2010-07-21 06:08:32

RSA is not only broken but also very inefficient. Why use asymmetric encryption when you can use symmetric?

NullUserException 2010-07-21 06:10:33

@NullUserException: I agree that in this case, symmetric encryption is a good option. However, I'm curious about RSA being broken - are you referring the to University of Michigan exploit which introduces voltage fluctutations into the CPU of the server holding the private key?

Mike 2010-07-21 06:55:44

@Mike "Textbook" RSA has been proven insecure for a while now. Regardless, RSA's recommended key size is 2048bits vs AES' 256-bit. Not only you have a much bigger key, but it takes a lot more time to compute.

NullUserException 2010-07-21 07:02:41

@NullUserException: I'm not disputing that asymmetric crptography is slower than symmetric crptography - that's why RSA is usually only used to encrypt keys for use in symmetric crptography. I was just curious about the details of the RSA exploit.

Mike 2010-07-21 07:06:21

ansaurus

tags:

views:

answers:

How to call a PHP script from a PHP script on another server

related questions