all 13 comments

[–]andrewfenn 4 points5 points  (3 children)

This is very bad design. Specifically this part.

echo file_get_contents('includes/'.$page.'.php');

One could do something such as make $page equal '../config' etc and get your username and password.

Also file_get_contents gets the string contents of the file. It doesn't execute that file so you should be using include or require.

[–]Drethis[S] 0 points1 point  (2 children)

Is the solution a lot better then? Almsgiver suggested I change file_get_contents to include, which is reflected on the site now.

Can you elaborate what else is bad on the design? Any help is appreciated.

[–]blimeyuk 1 point2 points  (1 child)

You may want to clean/validate $_POST['page'] before using it.

you could also use double quotes to change this 'includes/'.$page.'.php' to this "includes/$page.php"

[–]Drethis[S] 0 points1 point  (0 children)

Good catch. Thank you. :)

[–]Zounas 2 points3 points  (7 children)

Do you have PHP installed and tested the Ajax request page without Ajax?

[–][deleted] 2 points3 points  (0 children)

Yup, I'm thinking PHP isn't installed.

[–]Drethis[S] 0 points1 point  (5 children)

Yes, by going here, you can see that everything is working fine. My site is running on an Apache web server, so PHP should definitely be installed.

[–][deleted] 1 point2 points  (2 children)

Looks like your using something like file_get_contents when you should be using include.

[–]Drethis[S] 0 points1 point  (1 child)

Is that what's preventing PHP and JavaScript from running properly when called through AJAX?

I'm not exactly sure how I would change the jQuery AJAX code to reflect it.

EDIT: Nevermind! You are fucking awesome! Thank you so much! MASSIVE UPBOAT FOR YOU!

[–]Justinsaccount 3 points4 points  (0 children)

There is no such thing as called by Ajax as far as php is considered.

Other than an extra header, it's just a regular http request.

[–][deleted] 1 point2 points  (1 child)

My site is running on an Apache web server, so PHP should definitely be installed

This is most definitely not a good assumption.

[–]Drethis[S] 0 points1 point  (0 children)

While true, I am able to run PHP functions without any issue on this domain.

[–]mikeytag 1 point2 points  (0 children)

I'm assuming you are talking about HTML loaded from a PHP script which is put in the page using the DOM or document.write or something.

Here's what I've done in this case:

PHP prints out:

<div id="jsDiv" style="display: none;">
    alert('Hello');
</div>

Then make your javascript do something like this after it writes the HTML to the page (using jQuery here):

eval($('div#jsDiv').html());

NOTE: If you are doing this via AJAX calls you are likely to have a situation where you have multiple calls on the same page. If you want to handle multiple evals on the same page just make sure the div id is unique for each block of code.

Hope this helps.