Including remote file security

Python

For a script I am creating which will be used on other peoples hosts is it safe for me to remotely include a php file?

For example on devdreams.com there is a file called count.php and inside it it connects to my database and just update a counter. Then in the distributed script this count.php file is included using include()

Are there any security issues with this or are there any ways to stop them from finding out what is within the count.php file...

pfgannon

You can try something like phpaudit... Don't know if thats exactly what you're looking for though.

Chroder

It's quite safe

PHP Manual wrote:

If "URL fopen wrappers" are enabled in PHP (which they are in the default configuration), you can specify the file to be included using a URL (via HTTP or other supported wrapper - see Appendix M for a list of protocols) instead of a local pathname. If the target server interprets the target file as PHP code, variables may be passed to the included file using a URL request string as used with HTTP GET. This is not strictly speaking the same thing as including the file and having it inherit the parent file's variable scope; the script is actually being run on the remote server and the result is then being included into the local script.

The PHP code isn't being run on your server.

Unless you're reading a file and eval()'ing it, the only thing you need to watch out for is XSS.

Python

Ok thanks