Opening a file outside of the root

[dak888]

I'm doing my first real attempt at using php with mysql. I'm using dreamweaver to create the recordset and connection. Dreamweaver automatically creates a folder outside of my document root for my mysql connection settings and then places a link at the top of my page php like so:

<?php require_once('../Connections/mydatabase.php'); ?>

But I don't think it's finding the file. I've read that if the file in the require tag can't be found, it will break the php code. This would make sense since it's the first line of the document and if you view the source of the output, the page is completely blank!

I can see the file in remote view with dreamweaver but I can't see it with a ftp program. Is this a permissions issue or something?

Am I missing something completely obvious?

Take it easy on this PHP first timer.

DaK

[hostBrain]

Hi,
I'm assuming that the page you are putting this code in, is in your root directory?
Is the actual database folder with a capital c or small-case c (case-sensitivity)?
Are you getting any errors?

Also, why not try putting the Connections folder in the root directory, then change the code to

<?php require_once('Connections/mydatabase.php'); ?>

[dak888]

Hey hostBrain,

1. The page with the code is in the root.
2. The folder does have a capital "c". The file names are matched as they should be.
3. No errors what so ever. Just a blank page. Also, when I view the source, there is no source code at all (completely blank).
4. I don't want that file in the root as it contains sensitive information.

Thanks,

DaK

[LinksAndTraffic]

Originally Posted by dak888

Hey hostBrain,

1. The page with the code is in the root.
2. The folder does have a capital "c". The file names are matched as they should be.
3. No errors what so ever. Just a blank page. Also, when I view the source, there is no source code at all (completely blank).
4. I don't want that file in the root as it contains sensitive information.

Thanks,

DaK

Instead of loading your file path name like this:
../Connections/mydatabase.php

Try putting the full path from your server root
to your db file.

[southplatte]

You might want to check your site definition in dreamweaver as well, as you specify all the parameter for the server and it is possible that DW is using these urls for creating the links to the included files, thus breaking the link, that is if the stie definition is off.

[minorgod]

If you are on a shared server, you are probably FTP-ing into your document root, rather than your "home" directory which is above your document root. If your connections folder resides outside your document root, then you probably need to use the absolute path to the file in your include/require statment rather than a relative path. So instead of

<?php require_once('../Connections/mydatabase.php'); ?>

you would want something like

<?php require_once('/home/my_account_username/Connections/mydatabase.php'); ?>

You must also FTP your connections folder into the proper directory above your document root, which means if you have Dreamweaver or your FTP program configured to default to the site's document root, then you will have to either change your Dreamweaver site config to use the next highest level directory as your site root folder so that you will be able to upload necessarry files to the higher level directory. Alternately, I usually just use a separate FTP program (or preferably WinSCP for better security) so I can navigate outside my site root folder without changing my Dreamweaver config. In reality though, you are usually safe putting your config file in your document root since if someone tries to access the config file directly, it will be parsed by PHP anyway and will just show a blank screen since your connection file doesn't output anything to the screen if it is run in a browser. Now, if your PHP install got messed up, or there was a syntax error in the config file, then putting it in your web root could pose a risk. Of course, you could also throw an .htaccess file in the config directory (Linux only) to lock out web access. Anway, hope that helps.

Oh, and congratulations on taking your first steps as a PHP/MySQL developer. I too started out by coding PHP with Dreamweaver's built-in server behaviors, but soon found that it was easier to hand-code my PHP within dreamweaver. I still use dreamweaver constantly for it's visual editing capabilities, but spend most of my PHP time in code view. Either route you take, you are about to get a whole lot better at web development. Once you start to understand some of the basics, your eyes will open to a whole new world of possiblities for your skills. Just don't give up...it can be very frustrating at first, but it's worth it.

[iowarth]

As mentioned by Bill Platt I thinkyou need to use the absolute path i.e. a relative path or URL cannot access a reference which is outside the root directory. You will have to check waht the path is with your hos but it might well be something along the lines of /home/j/o/joebloggs.
Chris

[Christiaan]

If your file mydatabase.php is in a folder named 'Connections' of the root then there should be nothing wrong with using:

<?php require_once("Connections/mydatabase.php"); ?>

However, I always use double quotes in tese instances, as you can see.

[dak888]

Thanks everyone! I'll try some of these suggestions and post back my results. I appreciate all the tips.

DaK

[dak888]

Hmmmm. I must have something else wrong.

1. Looked at dreamweaver site manager settings, everything "looks" ok there.
2. Tried using a stand alone ftp program (smartFTP) to put the folder outside the root. However, it failed to put it there. I'm a regular user of smartFTP so I know how to use the program. Just got a "transfer failed" message every time I attempt it.
3. Tried putting the complete root path replacing the "../" but still nothing.
4. Finally broke down and put the folder in the root folder and changed the link, and to my surprise, still nothing.

This leads me to believe it may not be the path to the connections folder. Perhaps the generated code is not correct. *pulls hair out*

Damn this PHP (lol). It's just a simple site search engine to get my feet wet and I can't even get this correct!!!

Anywho.... here is the code.

<?php require_once('../Connections/mydatabase.php'); ?>
<?php
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "")
{
$theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;

$theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);

switch ($theType) {
case "text":
$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
break;
case "long":
case "int":
$theValue = ($theValue != "") ? intval($theValue) : "NULL";
break;
case "double":
$theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'" : "NULL";
break;
case "date":
$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
break;
case "defined":
$theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
break;
}
return $theValue;
}
}

$maxRows_simpleSearch = 10;
$pageNum_simpleSearch = 0;
if (isset($_GET['pageNum_simpleSearch'])) {
$pageNum_simpleSearch = $_GET['pageNum_simpleSearch'];
}
$startRow_simpleSearch = $pageNum_simpleSearch * $maxRows_simpleSearch;

$colname_simpleSearch = "-1";
if (isset($_GET['keywords'])) {
$colname_simpleSearch = (get_magic_quotes_gpc()) ? $_GET['keywords'] : addslashes($_GET['keywords']);
}
mysql_select_db($database_continental, $continental);
$query_simpleSearch = sprintf("SELECT PR_SKU, PR_Description, PR_ProductTextFile FROM PRODUCTS WHERE PR_Description LIKE CONCAT('%%', %s, '%%')", GetSQLValueString($colname_simpleSearch, "text"));
$query_limit_simpleSearch = sprintf("%s LIMIT %d, %d", $query_simpleSearch, $startRow_simpleSearch, $maxRows_simpleSearch);
$simpleSearch = mysql_query($query_limit_simpleSearch, $continental) or die(mysql_error());
$row_simpleSearch = mysql_fetch_assoc($simpleSearch);

if (isset($_GET['totalRows_simpleSearch'])) {
$totalRows_simpleSearch = $_GET['totalRows_simpleSearch'];
} else {
$all_simpleSearch = mysql_query($query_simpleSearch);
$totalRows_simpleSearch = mysql_num_rows($all_simpleSearch);
}
$totalPages_simpleSearch = ceil($totalRows_simpleSearch/$maxRows_simpleSearch)-1;
?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Untitled Document</title>
</head>

<body>

<table border="1">
<tr>
<td>PR_SKU</td>
<td>PR_Description</td>
<td>PR_ProductTextFile</td>
</tr>
<?php do { ?>
<tr>
<td><?php echo $row_simpleSearch['PR_SKU']; ?></td>
<td><?php echo $row_simpleSearch['PR_Description']; ?></td>
<td><?php echo $row_simpleSearch['PR_ProductTextFile']; ?></td>
</tr>
<?php } while ($row_simpleSearch = mysql_fetch_assoc($simpleSearch)); ?>
</table>
</body>
</html>
<?php
mysql_free_result($simpleSearch);
?>

Thanks everyone. Wish I could figure this out on my own.

DaK

[wige]

Some server configurations may not have or allow you to upload to any folder that is not part of your server tree. If that is the case, you can usually modify the .htaccess file so that it does not serve anything in your connections folder (but the PHP parser ignores .htaccess and will still access the script).

To get even more tricky, if you use a customized error 404 page, you can change the 403 error doc (shown to anyone who tries to access the connections folder) to use your custom 404 page instead. Just add a line to the top of the error page to change the header to 404 and casual observers should not be able to tell.

Also, for troubleshooting, do you have any level of command line access to the server? Unfortunately some PHP installations do not give much (or any) feedback when there are errors, and the only way to find out what the problem is is by running it through a PHP interpreter on the command line.

[dak888]

Thanks Wige,

We have "complete" access to our server. We have a dedicated server (not shared). The problem here is that I'm more of a designer than programmer so this is pretty new to me.

I'm sure I have command line access but I'm not sure what I'm doing. Is the procedure your talking about similar to "stepping through code" like I might do with VBA? I would love to be able to go line by line through the code to see where the problem is.

Any tips on using the command line? Or can you point me to a tutorial?

Thanks,

DaK

[southplatte]

Hey Dak,

You might check your PHP settings on error reporting and set it to show all errors - maybe that will show something up. If the file is not found, PHP should print an error message about it, if the code has something mucked up, PHP again should print an error message about it, that is true in both cases, unless error reporting has been suppressed in the PHP configuration.

Alternately you can also specify the level of reporting several other ways too:

PHP: error_reporting - Manual for more information on this....

Just seems that if the code is wrong, PHP would be spitting out errors on it, not just showing blank pages.

[dak888]

Ok........not sure "exactly what happened" but it's working now.

I changed the method to post from get (as well as any associated settings for variables) when a user presses the submit button and I moved the connection file into the root. Now it works.

Just need to add an .htaccess file to that folder and I should be good to go. Still doesn't explain why it won't get to the file outside of the root but I'm assuming it's some sort of permissions issue.

Anywho, thanks to everybody that provided input!

DaK

[vijeee]

some one give me a solution for the issue .

please help me

[vijeee]

i got the code it is woking



upload.html

<img src="upload.php?id=1205903408.jpg" width="412" height="252">


upload.php

<?php
ob_start();
$fname = $_GET["id"];
ini_set('include_path', 'give path outside root dir eg:/var/home/';
if (!file_exists("'give path outside root dir'".$fname))
{
echo "Error!! no such file in root";
exit;
}
echo $img = file_get_contents($fname,TRUE);
echo $im = imagecreatefromstring ($img);
header ("Content-Type: image/jpeg");
//imagegif ($im);
imageJPEG ($im);
imageDestroy ($im);
?>

it is working. sure i tested it.