How do I prevent an included PHP script from changing the Location URL?

Question

I'm including a PHP script that changes the URL.

// index.php
ob_start();
include "script.php";
   // This script redirects using  header("Location:");
$out = ob_get_clean();
// I use the $out data for calculations
echo $out;

Is there a simple way to counter or undo this unwanted redirect? How about:

header("Location: index.php");   // redirect back to self

But this causes an endless redirect loop... any ideas?

Or is there a way to strip out the header() calls from the $out buffer, preventing it from ever reaching the client?

Answer 1

You could try to overwrite that header field with an invalid value, such as:

header('Location: ', true);

But I don’t know how the clients react on that.

Answer 2

There isn't really a good way to do that. Two things come to mind:

1. Open script.php as a text file, strip out any header() commands and then eval() the result.
2. Echo a space before you include script.php and then trap the warning that PHP generates about issuing a header() after the output has already started. You'd need to echo the space before your output buffering.

Answer 3

What about including the file first as a variable with file_get_contents(), stripping out the unwanted headers and then running it with PHP code (I won't mention the evil word used to parse a PHP string as PHP code)?

Answer 4

Just for future references. As of PHP 5.3 there's a new function called header_remove() which helps dealing with such situations.

Answer 5

Since you have the complete text in a string before you output it, you can simple remove the headers you want with a search and replace (using a regex for example).

Answer 6

If you don't have PHP5.3 at your disposal (you probably don't), Gumbo's answer does not work and you don't want to use eval, then the only other option I can see, is the use of streams. This is however yet another, more flexible but complex, form of eval. Streams, combined with tokenizer, and you'll be able to get rid of that function call with a simple:

require 'no-header://script.php';