include_path and absolute paths in include functions

[Steven Stromer]

For years I was lulled into thinking I understood php include functions...

I have always used relative paths in my include and related functions,
for instance:
include_once ("lib/included.php");

However, I am now needing to switch to absolute paths:
include_once ("/lib/included.php");

This doesn't work. Generates error:

Warning: main(/lib/included.php) [function.main.html]: failed to open
stream: No such file or directory in /var/www/sites/sitename/index.php
on line 8

Warning: main() [function.include.html]: Failed opening
'/lib/included.php' for inclusion
(include_path='.:/var/www/sites/sitename') in
/var/www/sites/sitename/index.php on line 8

I would think I need to correct the include_path in php.ini, but the
include_path seems right. The file I want to include does exist at:
/var/www/sites/sitename/lib/included.php

I always believed that the include_path and the path in the include()
function were simply concatenated, but I now think that I am just plain
wrong, as the error is reproducible on OS X, Fedora and everywhere else
I test it.

Am I not taking into account some other directive that affects
include_path, like 'doc_root' in php.ini, or 'DocumentRoot' or
'ServerRoot' in httpd.conf? Or is this a permissions issue of some sort?

Thanks for any help in advance!

[Jochem Maas]

Post by Steven Stromer
For years I was lulled into thinking I understood php include functions...
I have always used relative paths in my include and related functions,
include_once ("lib/included.php");

this is what should work given you ini path. maybe check the file
permissions are in order.

Post by Steven Stromer
include_once ("/lib/included.php");

why do you need to do that? that include will bypass the include_path
and only look in the /lib dir on your machine - which is not what you want I think.

...

[Steven Stromer]

Post by Jochem Maas

Post by Steven Stromer
include_once ("/lib/included.php");

why do you need to do that? that include will bypass the include_path
and only look in the /lib dir on your machine - which is not what you want I think.

Thanks everyone for your great responses. What was my rationale for
wanting to use a leading '/'?

A fair question. A flickering memory of a vague warning on some web page
that using anything but absolute paths in include functions creates a
security risk. Also, some unclear documentation in a certain, popular
PHP/MySQL book (I won't name names) that I got started with a few years
back.

My misunderstanding was that there is a concatenation taking place
between include_path and the argument being passed to include(). I
believe that I am now understanding correctly that the two options are:

a. Creating a relative path to the include, for instance:
include_once ("lib/included.php");

or

b. Putting the include into a directory listed in include_path, which
basically has the same effect as using absolute paths - the effect being
that if the file containing the include() call is moved to a different
directory, the included file will still be found successfully, without
having to keep the path relationship between the two files intact.

Further, I read (in the same PHP book) that it is best to refer to
included files within the same directory like so:
include_once ("./included.php");

However, this would make the path relative, and would thus break if the
file containing the include() call were to be moved, as I understand
UNIX directory naming. Is there any benefit to doing this that would
override my wish to be able to move files around with more freedom?

Finally, is there any greater security risk in using one or the other of
relative versus 'include_path'-based paths? I know that putting a
variable into the path is a no-no, but any other considerations?

Thanks again all!

[D. Dante Lorenso]

If you are using PHP 5, you might have some fun with the __autoload()
function. I use something like this in production:

//----------------------------------------------------------------------
function __autoload($class_name) {
require_once ($class_name.".php");
}

function push_libs() {
$paths = func_get_args();
foreach ($paths as $path) {
$ipath =
ini_get("include_path").":".dirname(__FILE__)."/".$path;
ini_set("include_path", $ipath);
}
}

// where are the class files?
push_libs("lib", "lib/application", "lib/db", "lib/ui", "lib/util",
"lib/xmlrpc");

//----------------------------------------------------------------------

This code assumes that all the included library paths are relative to
the file which contains this code.

Dante

[Richard Lynch]

Post by Steven Stromer
relative versus 'include_path'-based paths? I know that putting a
variable into the path is a no-no, but any other considerations?

I suspect that the advice to use absolute paths is somebody NOT
understanding the include_path system, and just "giving up" on it,
possibly combined and confused with not using an unconstrained
variable in the path...

Nothing irks me more than stupidly-designed software that hard-codes
paths into includes so I can't move all their include files OUT of the
web-tree without a lot of grief.

More than a few software packages will not get installed for my
clients, no matter how nice the software might seem, until this is
fixed, because I just don't have the time to fix their mistakes.

[D. Dante Lorenso]

Post by Steven Stromer
For years I was lulled into thinking I understood php include
functions...
I have always used relative paths in my include and related functions,
include_once ("lib/included.php");
include_once ("/lib/included.php");
Warning: main(/lib/included.php) [function.main.html]: failed to open
stream: No such file or directory in /var/www/sites/sitename/index.php
on line 8
Warning: main() [function.include.html]: Failed opening
'/lib/included.php' for inclusion
(include_path='.:/var/www/sites/sitename') in
/var/www/sites/sitename/index.php on line 8

You are confusing the web server's DOCUMENT_ROOT with your server's unix
file system root directory '/'.

Post by Steven Stromer
I would think I need to correct the include_path in php.ini, but the
/var/www/sites/sitename/lib/included.php
I always believed that the include_path and the path in the include()
function were simply concatenated, but I now think that I am just
plain wrong, as the error is reproducible on OS X, Fedora and
everywhere else I test it.
Am I not taking into account some other directive that affects
include_path, like 'doc_root' in php.ini, or 'DocumentRoot' or
'ServerRoot' in httpd.conf? Or is this a permissions issue of some sort?

If you want to include a file which stems from the DOCUMENT_ROOT, try
something like this:

* include_once($_SERVER['DOCUMENT_ROOT']."/lib/included.php");

Since absolute paths are relative to the server root, this will
correctly map the full path. Very likely from what you stated above,
this is true:

* $_SERVER['DOCUMENT_ROOT'] == "/var/www/sites/sitename"

Dante

[Richard Lynch]

Post by Steven Stromer
For years I was lulled into thinking I understood php include
functions...
I have always used relative paths in my include and related functions,
include_once ("lib/included.php");
include_once ("/lib/included.php");

This would require that your have something like this on your server:

/bin
/root
/lib/included.php

Post by Steven Stromer
Warning: main(/lib/included.php) [function.main.html]: failed to open
stream: No such file or directory in /var/www/sites/sitename/index.php
on line 8
Warning: main() [function.include.html]: Failed opening
'/lib/included.php' for inclusion
(include_path='.:/var/www/sites/sitename') in
/var/www/sites/sitename/index.php on line 8
I would think I need to correct the include_path in php.ini, but the
/var/www/sites/sitename/lib/included.php
I always believed that the include_path and the path in the include()
function were simply concatenated, but I now think that I am just plain
wrong, as the error is reproducible on OS X, Fedora and everywhere else
I test it.

Don't put the '/' in the front, and they are concatenated.

Put a '/' on the front, and PHP assumes you are giving a COMPLETE and
ABSOLUTE path in the file-system.

Post by Steven Stromer
Am I not taking into account some other directive that affects
include_path, like 'doc_root' in php.ini, or 'DocumentRoot' or
'ServerRoot' in httpd.conf? Or is this a permissions issue of some sort?

include 'lib/included.php';

should have worked in the first place.

Go back to that, and then double-check spelling and include_path from
within the PHP script.