NYCPHP Meetup

NYPHP.org

[nycphp-talk] Re: PHP_SELF problems

Dan Cech dcech at phpwerx.net
Fri Dec 29 14:50:33 EST 2006


Michael Sims wrote:
> On Friday 29 December 2006 2:00 pm, Dan Cech wrote:
> 
>> Yes, If you want the full filename (including filesystem path) __FILE__
>> is indispensable, and basename(__FILE__) is the best way to get the name
>> of the currently running script.
>>
>> The problem comes when you're attempting to construct the correct
>> absolute URL for a given file.  When running php as a cgi there doesn't
>> seem to be a method of achieving this securely, as in this setup
>> $_SERVER['SCRIPT_NAME'] will contain the php interpreter, like
>> '/php-cgi'.
>>
>> Bottom line is that if your script will be run under php-cgi you must
>> not use SCRIPT_NAME, so we're back to square one.
> 
> There's a solution for that (two solutions in fact, either a php.ini setting 
> or a different variable):
> 
> http://www.symfony-project.com/trac/ticket/842
> 
> So I suppose the canonical solution would be something like:
> 
> $thispage = (isset($_SERVER['ORIG_SCRIPT_NAME'])) ? 
> $_SERVER['ORIG_SCRIPT_NAME'] : $_SERVER['SCRIPT_NAME'];
> 
> How's that?  That should work anywhere, right?
> 
> (Disclaimer: I never use PHP as a cgi script and can't test this.)

Hmm, I wasn't aware of the .ini fix, that's good to know.  After
changing it to cgi.fix_pathinfo=1 (default is 0), SCRIPT_NAME functions
as expected.  I'm not that thrilled with requiring a non-standard
php.ini setting but it will work for the moment.

To add insult to injury, ORIG_SCRIPT_NAME is only being populated when
this is set to 1, at which point you don't need it for what we're trying
to do!

Dan



More information about the talk mailing list