php.ini include_path和ssi

Question

I have an ssi directory outside of my website webroot (var/www/shared/ssi)

I would like all differnet virtual hosts on the server to be able to access files in this directory so I added the path to include_path in php.ini

Now I can simply do the following to load ssi files in this directory.

<?php include 'header.htm'; ?>

My question is - is this good practice? And should I be aware of any security implications of doing this?

Thanks

Answer 1

The command

<?php include 'header.htm'; ?>

will execute any PHP code inside header.htm . If you can't fully trust its contents, it's not a good idea. In that case, do

<?php readfile("header.htm"); ?>

this will read the file, not execute any PHP code in it, and output it.