Auto_prepend_file

[Schraalhans Keukenmeester]

I am considering using the php 'auto_prepend_file' directive to have a
few default things loaded and some superglobals unset for all customers
using my server. The intended file does not produce any output to the
browser, just sets a few variables, modifies/unsets a few server &
environment variables, defines a few constants and loads a custom ftp
class definition.

It seems temptingly easy to do so, but I would like to have some insight
in what can of worms I may be opening going this route. Are there strong
arguments pro/against using this feature? Some great examples perhaps?

Thanks for your advice in advance!
Sh.

[-Lost]

Schraalhans Keukenmeester wrote:

I am considering using the php 'auto_prepend_file' directive to have a
few default things loaded and some superglobals unset for all customers
using my server. The intended file does not produce any output to the
browser, just sets a few variables, modifies/unsets a few server &
environment variables, defines a few constants and loads a custom ftp
class definition.

It seems temptingly easy to do so, but I would like to have some insight
in what can of worms I may be opening going this route. Are there strong
arguments pro/against using this feature? Some great examples perhaps?

Remember that it mimics include(), so include_path is what is used.

Other than that, I see nothing wrong with it. Assuming your code does
not expose any information, and your server is setup to properly deliver
the content. As in, PHP is delivered as PHP.

--
-Lost
Remove the extra words to reply by e-mail. Don't e-mail me. I am
kidding. No I am not.

[-Lost]

-Lost wrote:

Schraalhans Keukenmeester wrote:

>I am considering using the php 'auto_prepend_file' directive to have a
few default things loaded and some superglobals unset for all customers
using my server. The intended file does not produce any output to the
browser, just sets a few variables, modifies/unsets a few server &
environment variables, defines a few constants and loads a custom ftp
class definition.

It seems temptingly easy to do so, but I would like to have some insight
in what can of worms I may be opening going this route. Are there strong
arguments pro/against using this feature? Some great examples perhaps?

Remember that it mimics include(), so include_path is what is used.

Other than that, I see nothing wrong with it. Assuming your code does
not expose any information, and your server is setup to properly deliver
the content. As in, PHP is delivered as PHP.

Oh, and don't use exit().

--
-Lost
Remove the extra words to reply by e-mail. Don't e-mail me. I am
kidding. No I am not.

[Schraalhans Keukenmeester]

At Sat, 12 May 2007 11:26:47 -0400, -Lost let his monkeys type:

-Lost wrote:

>Schraalhans Keukenmeester wrote:

>>I am considering using the php 'auto_prepend_file' directive to have a
few default things loaded and some superglobals unset for all customers
using my server. The intended file does not produce any output to the
browser, just sets a few variables, modifies/unsets a few server &
environment variables, defines a few constants and loads a custom ftp
class definition.

It seems temptingly easy to do so, but I would like to have some insight
in what can of worms I may be opening going this route. Are there strong
arguments pro/against using this feature? Some great examples perhaps?

Remember that it mimics include(), so include_path is what is used.

Other than that, I see nothing wrong with it. Assuming your code does
not expose any information, and your server is setup to properly deliver
the content. As in, PHP is delivered as PHP.

Oh, and don't use exit().

I think I've read somewhere exit() only has implications for
auto_APpend_file, not for its prepend counterpart. But undoubtedly you
know more about it. Glad to hear!

I also read -as you stated- it handles the file as an include, which may
lead to problems if the file is specifically included later, or a
function definition is repeated later on.

One advantage is I can prepend stuff completely outside the docroot AND
include_path, so no script could ever re-include it. The php include_path
doesn't limit this feature, at least not in my setup. It takes an absolute
or relative filepath (relative to the php.ini dir).

Then there are quite a few reported bugs, but I haven't seen chance yet to
inspect all these reports, some of which from the google synopsis alone
can be filed under 'User Error'.

I'll test it first, see how well it works, if there are many hickups or
unexplained/unexpected behaviours involved.

Thanks for your comments!
Sh.

[Jerry Stuckle]

Schraalhans Keukenmeester wrote:

I am considering using the php 'auto_prepend_file' directive to have a
few default things loaded and some superglobals unset for all customers
using my server. The intended file does not produce any output to the
browser, just sets a few variables, modifies/unsets a few server &
environment variables, defines a few constants and loads a custom ftp
class definition.

It seems temptingly easy to do so, but I would like to have some insight
in what can of worms I may be opening going this route. Are there strong
arguments pro/against using this feature? Some great examples perhaps?

Thanks for your advice in advance!
Sh.

I wouldn't.

Environment variables for all users should be set before Apache starts.
Then they'll all be available. And which superglobals are you
referring to? I'd get fairly upset if one of the superglobals I need is
missing. Same with server variables.

As for variables - what would be the purpose? And what if one of the
scripts I use happens to use those same variables? Or a class with the
same name as your custom ftp class? There's a reason most hosts don't
do this - it can screw up someone's scripts.

Also, you're forcing the parser to parse more code for every PHP script
out there - whether it's needed or not.

Just set everything up in your Apache start script and let it run. And
if you want to give them access to your custom FTP class, let them have it.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================

[-Lost]

Jerry Stuckle wrote:

Schraalhans Keukenmeester wrote:

>I am considering using the php 'auto_prepend_file' directive to have a
few default things loaded and some superglobals unset for all customers
using my server. The intended file does not produce any output to the
browser, just sets a few variables, modifies/unsets a few server &
environment variables, defines a few constants and loads a custom ftp
class definition.

It seems temptingly easy to do so, but I would like to have some insight
in what can of worms I may be opening going this route. Are there strong
arguments pro/against using this feature? Some great examples perhaps?

I wouldn't.

Environment variables for all users should be set before Apache starts.
Then they'll all be available. And which superglobals are you
referring to? I'd get fairly upset if one of the superglobals I need is
missing. Same with server variables.

As for variables - what would be the purpose? And what if one of the
scripts I use happens to use those same variables? Or a class with the
same name as your custom ftp class? There's a reason most hosts don't
do this - it can screw up someone's scripts.

Also, you're forcing the parser to parse more code for every PHP script
out there - whether it's needed or not.

Just set everything up in your Apache start script and let it run. And
if you want to give them access to your custom FTP class, let them have it.

These are all really good points.

I would add then, that I would still use this method, but on a
per-application basis. You could use it with .htaccess, and apply only
to the directories needed.

Especially if you know what should or should not be going on for a user
at the start of a certain area. For example, upon login. Then again,
one might wonder why you would bother if it was only needed in the login
script.

It is still a smart, and viable option. Just not in the examples you
quoted above.

Surprisingly, most examples I found on the subject never discussed their
use (auto_prepend_file and auto_append_file) as automatic header and
footer inserts.

--
-Lost
Remove the extra words to reply by e-mail. Don't e-mail me. I am
kidding. No I am not.

[-Lost]

Schraalhans Keukenmeester wrote:

I think I've read somewhere exit() only has implications for
auto_APpend_file, not for its prepend counterpart. But undoubtedly you
know more about it. Glad to hear!

Oh no, you are exactly right. Well, kind of.

Using exit() in the append file results in the append file never being
appended.

But think about a prepend file. If you use die or exit anywhere, the
rest of the script is killed. That means whatever you prepended a file
into.

>
I also read -as you stated- it handles the file as an include, which may
lead to problems if the file is specifically included later, or a
function definition is repeated later on.

One advantage is I can prepend stuff completely outside the docroot AND
include_path, so no script could ever re-include it. The php include_path
doesn't limit this feature, at least not in my setup. It takes an absolute
or relative filepath (relative to the php.ini dir).

Exactly. Not to mention your coding guidelines and or application
structure should dictate how all includes are handled.

One example is testing for a given variable. For example, I prepend a
file called reset.php to certain session applications. To make sure
that is available in an easy sense, I simply throw "$reset = true;" at
the end of it.

Then I can just if ($reset) { // don't reinclude } or something similar.

Then there are quite a few reported bugs, but I haven't seen chance yet to
inspect all these reports, some of which from the google synopsis alone
can be filed under 'User Error'.

Current bugs? Most of the ones I knew about were solved in the later
versions of PHP 4 and surely now by 5.

I'll test it first, see how well it works, if there are many hickups or
unexplained/unexpected behaviours involved.

Please do. Make sure to post them as well.

Thanks for your comments!

If they helped, you are quite welcome!

--
-Lost
Remove the extra words to reply by e-mail. Don't e-mail me. I am
kidding. No I am not.

[Jerry Stuckle]

-Lost wrote:

Jerry Stuckle wrote:

>Schraalhans Keukenmeester wrote:

>>I am considering using the php 'auto_prepend_file' directive to have a
few default things loaded and some superglobals unset for all customers
using my server. The intended file does not produce any output to the
browser, just sets a few variables, modifies/unsets a few server &
environment variables, defines a few constants and loads a custom ftp
class definition.

It seems temptingly easy to do so, but I would like to have some insight
in what can of worms I may be opening going this route. Are there strong
arguments pro/against using this feature? Some great examples perhaps?

I wouldn't.

Environment variables for all users should be set before Apache
starts. Then they'll all be available. And which superglobals are
you referring to? I'd get fairly upset if one of the superglobals I
need is missing. Same with server variables.

As for variables - what would be the purpose? And what if one of the
scripts I use happens to use those same variables? Or a class with
the same name as your custom ftp class? There's a reason most hosts
don't do this - it can screw up someone's scripts.

Also, you're forcing the parser to parse more code for every PHP
script out there - whether it's needed or not.

Just set everything up in your Apache start script and let it run.
And if you want to give them access to your custom FTP class, let them
have it.

These are all really good points.

I would add then, that I would still use this method, but on a
per-application basis. You could use it with .htaccess, and apply only
to the directories needed.

Especially if you know what should or should not be going on for a user
at the start of a certain area. For example, upon login. Then again,
one might wonder why you would bother if it was only needed in the login
script.

It is still a smart, and viable option. Just not in the examples you
quoted above.

Surprisingly, most examples I found on the subject never discussed their
use (auto_prepend_file and auto_append_file) as automatic header and
footer inserts.

Probably because not many people are doing it due to the potential problems.

Some free hosting services will use prepend and append files (html
and/or php) on their free sites to place ads. But that's about all.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================