NYCPHP Meetup

[Scott Mattocks]

Fan, Wellington wrote:

> I am under complete control of $path_to_file -- AND it will likely point to
> a file outside of docroot.
> 
> So, besides the potential injection problems of the above code, any other
> way to parse a PHP file and return as a string?

If you put a return value in the file it will be returned by the include 
call.

From: http://us2.php.net/manual/en/function.include.php

Handling Returns: It is possible to execute a return()  statement inside 
an included file in order to terminate processing in that file and 
return to the script which called it. Also, it's possible to return 
values from included files. You can take the value of the include call 
as you would a normal function. This is not, however, possible when 
including remote files unless the output of the remote file has valid 
PHP start and end tags (as with any local file). You can declare the 
needed variables within those tags and they will be introduced at 
whichever point the file was included.

Scott Mattocks