PHP Inserts


#1

I am moving a site to DH which uses PHP inserts to provide newsfeeds. I don’t like using JS as it is slow and the pages can’t be indexed by Google etc. Dreamhost do not allow PHP inserts and FeedDigest recommend using cURL (as did DH, as far as I knew). However DH now suggest installing PHP on my directory and using
fopen.

[i]"Well… you could use fopen: All f_open functions on the server have been disabled for security
reasons.

If you would like to use them, you may compile your own version of PHP.
Information is in the wiki for PHP4, and PHP5 respectively at the
following addresses:
http://wiki.dreamhost.com/index.php/Installing_PHP4
http://wiki.dreamhost.com/index.php/Installing_PHP5
Or write something in perl. As far as curl, I wouldn’t use shell
commands from a website, it’s like an exploit waiting to happen."[/i]

I would really appreciate a simple explanation of how I can get my feeds to work on DH without going back to JS. While I’m nboe a complete noobie I am an old geezer more comfortable with steam driven technology, so go easy please!


#2

I don’t understand what you mean by “PHP inserts”, but if you can show me an example of the code you are having problems with, I might be able to help.

Anything that requires the retrieval of resources from external sites is best done with cURL.


Simon Jessey | Keystone Websites
Save $97 on yearly plans with promo code [color=#CC0000]SCJESSEY97[/color]


#3

MikeP,

Did I understand correctly that someone from Dreamhost provided that information? While I do not work for Dreamhost (I’m just a customer like you), that seems to me to be “questionable” advice and information. If Dreamhost has, in fact, disabled “all f_open functions”, they have done it very recently, and without an announcement of any kind. In fact, I just don’t believe it is true (scripts would be “breaking” all over the place, and we would be seeing the fallout of it on this forum).

What Dreamhost has announced having disabled is “allow_url_fopen”, and that is a "Good Thing"tm for security. As you can see in the linked article, a good replacement for allow_url_fopen is cURL. I think that the advice you were given by FeedDigest is good advice :wink:

[quote]…“If you would like to use them, you may compile your own version of PHP.
Information is in the wiki for PHP4, and PHP5 respectively at the following addresses:
http://wiki.dreamhost.com/index.php/Installing_PHP4
http://wiki.dreamhost.com/index.php/Installing_PHP5
Or write something in perl. As far as curl, I wouldn’t use shell commands from a website, it’s like an exploit waiting to happen.”[/quote]
I can only assume that this came from the same source as the statement that all “f_open” functions were disabled, and I’m really interested in the fact that you indicate that advice came from Dreamhost staff :open_mouth: . Firstly, you can still use “fopen” functions in your sites without having to recompile your own version of PHP - you just can’t use “allow_url_fopen”, as previously stated. Many sites use fopen fuctions all the time to open “local” files that live on their server, and there is nothing wrong with doing that. This gives you another possible workaround for using feeds, as you could use wget to retrieve copies of your feeds from the web and place them on your space, and the use fopen to access them (though I think that cURL is a much better soulution, as it is more secure, and easier to implement).

As for the advice, “As far as curl, I wouldn’t use shell commands from a website, it’s like an exploit waiting to happen,” I can only disagree strongly. cURL is what has been recommended by Dreamhost Head Honcho and Founder Dallas since even before the day they disabled the use of allow_url_fopen on Dreamhost servers.

Compiling and using your own PHP in order to enable a “dangerous” function that Dreamhost has disabled by default to increase the security of all on a shared server carries with it a huge responsibility, and one should be very sure of what they are doing before attempting such a thing. In fact, while I do not mean this to be critical of you in any way, if one does not fully understand why cURL is “better” than “allow_url_fopen”, and all the ways that allow_url_fopen can be exploited, they should not be doing this at all!

A little reading on cURL should make it relatively simple for you to modify your PHP to grab your feeds via cURL, and that is what I recommend you should do.

There many posts in this forum , with example code, to help you and the wiki has a great article on the use of curl (a link to that article is included in the previous wiki article I linkdd). Also, there are links in the post by Dallas (linked above) to another tutorial on the use of cURL that was used by many Dreamhosters to help adapt to the loss of all_url_fopen. Finally, there are many regular users on this forum who are proficient in the use or cURL, and have helped many users who post with specific questions or problems.

As another alternative, you might “google” for Magpie RSS, which some find easier to adapt for use on Dreamhost (and which I have used repeatedly to grab feeds) Good Luck!

–rlparker


#4

Wow, that was a quick response, thanks!

This is the code from FeedDigest which they refer to as a PHP insert:

<?php
include (“http://app.feeddigest.com/digest3/WY0KUW3HX5.html”);
?>

These are the two responses from Dreamhost:

Hi Mike,
Sorry, but we don’t give any direct PHP coding support or
troubleshooting. You can in fact enable external URL including if you want, but you’ll have to install your own version of PHP in your home directory and change this setting in that php.ini file. Again, you can find out more information on that here:
http://wiki.dreamhost.com/index.php/Installing_PHP4
http://wiki.dreamhost.com/index.php/Installing_PHP5
Let me know if you have any other questions. Thanks! Charlie

And:

Well… you could use fopen: All f_open functions on the server have been disabled for security reasons.If you would like to use them, you may compile your own version of PHP. Information is in the wiki for PHP4, and PHP5 respectively at the
following addresses: (etc as above - MikeP)
Or write something in perl. As far as curl, I wouldn’t use shell
commands from a website, it’s like an exploit waiting to happen.
If there is anything else I can do for you please let me know!
Thanks! Michael P

I sent this to Peter at FeedDigest, a very nice and helpful guy by the way:

[i]Dreamhost disable the ability for PHP to access files via a URL. I want to move a site to DH and continue using PHP inserts… Do I have to add this code below (from the DH wiki) instead of the php insert for every feed? Or what?!..

<?php $ch = curl_init(); $timeout = 5; // set to zero for no timeout curl_setopt ($ch, CURLOPT_URL, 'http://example.com'); curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout); $file_contents = curl_exec($ch); curl_close($ch); // display file echo $file_contents; ?>[/i]

To which he replied:

That code has a URL in it. Replace that URL with your Feed Digest’s HTML URL. Then it’ll work. Surprised to hear them saying not to use curl though, as they suggested it in the first place! Not sure what he means about compiling your own PHP. Are you on an unmanaged server or something?

Followed by this response to the second DH reply:

I didn’t realize the curl technique in PHP used the shell curl. I wonder why they recommend it then?!

I tried changing the URL and replacing the PHP with the curl code but still no luck . Maybe it’s the wrong snippet of code?


#5

You’re welcome! Thanks for posting the support history, both from Peter at FeedDigest, and from Dreamhost.

I’ve already commented on the Dreamhost response, so I won’t recap any of that, but one things Peter said should probably be clarified:

They recommend it because it is a good way to do this; I don’t know what “MichaelP” was getting at. PHP on Dreamhost is compiled “with-curl=/usr”, and uses the the libraries ibcurl/7.13.2, OpenSSL/0.9.7e, zlib/1.2.2, and libidn/0.5.13 (from phpinfo) - you don’t have to “shell” out to command line curl to use the curl functions (see the php.net manual for “curl”).

At any rate, this should get you going:

[quote]

<?php $ch = curl_init(); $timeout = 5; // set to zero for no timeout curl_setopt ($ch, CURLOPT_URL, 'http://app.feeddigest.com/digest3/WY0KUW3HX5.html'); curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout); $file_contents = curl_exec($ch); curl_close($ch); // display file echo $file_contents; ?>[/quote]

This code “works” (with the url supplied from your last post). It also works without the “http://” in front of the rest of the url. You can see the “raw” output at this url , which I’ll leave up for a day or so. I would have experimented with it more, but FeedDigest is not taking any new Signups, so I couldn’t explore the various feeds/configurations available.

It seems a little silly to me to have a “single article” feed, but maybe that is just a characteristic of that feed, and the day’s activity :wink:

At any rate, this should get you going, and if not, scjessey is the “curl guru”, and he might can give you better guidance with particulars, if you post some sample code in response to his post (so he sees it!) Good Luck!

–rlparker


#6

Actually, I’m not. When I first heard that DreamHost was toying with the idea of disabling allow_url_fopen, I did a bit of research. I tested an example, and then wrote about it in the wiki. The funny thing is that I don’t actually use it myself, because I don’t need it!


Simon Jessey | Keystone Websites
Save $97 on yearly plans with promo code [color=#CC0000]SCJESSEY97[/color]


#7

Well, you are a “guru” at it compared to me! :slight_smile: Most of what I know about it I learned from your WIki article and subsequent forum posts (with a little help from the docs and PHP.net).

I don’t use it much either; when I need to include a feed I generally use magpie RSS.

–rlparker


#8

I must have messed up somewhere, still it’s nice to know that I was on the right track. Oh the single feed? I just grabbed the first one on my list which was a spare ‘test’ feed. Having said that I have used single feeds in the past to make changing posts in sidebars easy. Just bookmark to your favourite service and it replaces the previous piece on your page. Blinklist allows html so you can include extra links and even images. Simple!

To be fair to Peter, who has a link to the curl info on his site, he wasn’t questioning why they recommend it but rather why they do so and then advise against it in the support ticket reply. I truncated his reply which gave a somewhat false impression, sorry (and sorry Peter too!)

I’ve never had much luck with forums in the past which is why I’ve never been here before but after this experience this will be my first port of call - ok, my second after ‘extensive research’, :slight_smile:

Thanks again.


#9

Yikes! I most emphatically did not mean for my comments to be negative toward Peter in any way! His comment made perfect sense; it was MichaelP’s that I couldn’t fathom :wink:

All that’s neither here nor there at this point. What is important is that you got some help and can now get your feeds working properly, and I’m glad you found the forum experience to be worthwhile! :slight_smile:

–rlparker