如何使用PHP请求非公开的PHP页面？

Question

To request a public-facing page, you can simply do:

$html = file_get_contents("http://mysite.com/file.php");

But the file I want to request is not a publicly available page. Is there any way to request it without resorting to server configurations?

To be clear, I do not want the source code of the .php file - I want to execute the PHP in the file and get the resulting html as a string.

Answer 1

您可以使用这样的命令行调用来调用php文件

$content = shell_exec('php /path/to/your/file.php');

Answer 2

If the file is not a public facing file, your first move is to put it in a location that public cannot access, eg, not in your sites public folder, but a level up from there. That way, nobody will ever be able to access it, except for files residing on the same server.

Next, instead of using file_get_contents() to load up a url, use exec() to execute the php script like this

exec('php /path/to/file.php', $output);
print_r($output); // each line of the output is stored in the $output array

See http://php.net/manual/en/function.exec.php for mroe info

Answer 3

But the file I want to request is not a publicly available page. Is there any way to request it without resorting to server configurations?

If it's an external file, no, there isn't a way to by-pass server configurations. Essentially by pointing file_get_contents() to a PHP file, you are telling the web server to execute it and if it was made to print a bunch of information, it will exactly do that. CURL may be the better choice if you are trying to access .htaccess password protected files.

Answer 4

This can be done by making the file public, but protecting it with a password. Then the page will still be protected from the outside world, but can be requested with file_get_contents().

In the requesting page:

$html = file_get_contents("http://mysite.com/file.php?password=h29kd8cm28x");

And in the (now public) page being requested:

if ($_GET['password'] != 'h29kd8cm28x') {
    die("Access denied!");
} else {
    // page contents here
}

However this seems like a clunky solution, and requires extra work to prevent hackers from learning the password.

Answer 5

You need to keep the PHP file in document root or its sub-folders. Assuming you are calling call.php from run.php:

// call.php
if($_SERVER['REQUEST_URI']=='run.php') { // Or the full path of run.php
    // Code here
}

// run.php
$html = file_get_contents("http://sitename.com/call.php");

If call.php should be outside the document root, shell_exec is an option, as mentioned by silly.