PHP Newbie - PHP Notice: Undefined index: DOC_ROOT

Oh.

And I REALLY meant to type ...

<?php phpinfo(); >?

fingggggers slipped on the g.

Though ph ping fo sounds a LOT better!

<grin>

Richard.

On phpinfo, I see this:

doc_root c:/Inetpub/wwwroot/PHP_Stuff

So, why doesn't $fp = fopen("$DOCUMENT_ROOT/Orders/orders.txt", 'a');  work if the file is located: C:\Inetpub\wwwroot\PHP_Stuff\Orders\orders.txt

??





ps. I liked the phping...  :)

Can you cut and paste the entire line showing the doc_root variable?

Is it ...

_SERVER["DOCUMENT_ROOT"]

Also, from the PHP Manual ...

doc_root string
PHP's "root directory" on the server. Only used if non-empty. If PHP is configured with safe mode, no files outside this directory are served. If PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root if you are running php as a CGI under any web server (other than IIS) The alternative is to use the cgi.force_redirect configuration below.



The following steps are optional.


Edit your new php.ini file. If you plan to use OmniHTTPd, do not follow the next step. Set the doc_root to point to your webservers document_root. For example:


doc_root = c:\inetpub        // for IIS/PWS

doc_root = c:\apache\htdocs // for Apache
 



Choose which extensions you would like to load when PHP starts. See the section about Windows extensions, about how to set up one, and what is already built in. Note that on a new installation it is advisable to first get PHP working and tested without any extensions before enabling them in php.ini.

On PWS and IIS, you can set the browscap configuration setting to point to: c:\windows\system\inetsrv\browscap.ini on Windows 9x/Me, c:\winnt\system32\inetsrv\browscap.ini on NT/2000, and c:\windows\system32\inetsrv\browscap.ini on XP.





Installed as CGI binary
Possible attacks
Using PHP as a CGI binary is an option for setups that for some reason do not wish to integrate PHP as a module into server software (like Apache), or will use PHP with different kinds of CGI wrappers to create safe chroot and setuid environments for scripts. This setup usually involves installing executable PHP binary to the web server cgi-bin directory. CERT advisory CA-96.11 recommends against placing any interpreters into cgi-bin. Even if the PHP binary can be used as a standalone interpreter, PHP is designed to prevent the attacks this setup makes possible:


Accessing system files: http://my.host/cgi-bin/php?/etc/passwd

The query information in a url after the question mark (?) is passed as command line arguments to the interpreter by the CGI interface. Usually interpreters open and execute the file specified as the first argument on the command line.

When invoked as a CGI binary, PHP refuses to interpret the command line arguments.

Accessing any web document on server: http://my.host/cgi-bin/php/secret/doc.html

The path information part of the url after the PHP binary name, /secret/doc.html is conventionally used to specify the name of the file to be opened and interpreted by the CGI program. Usually some web server configuration directives (Apache: Action) are used to redirect requests to documents like http://my.host/secret/script.php to the PHP interpreter. With this setup, the web server first checks the access permissions to the directory /secret, and after that creates the redirected request http://my.host/cgi-bin/php/secret/script.php. Unfortunately, if the request is originally given in this form, no access checks are made by web server for file /secret/script.php, but only for the /cgi-bin/php file. This way any user able to access /cgi-bin/php is able to access any protected document on the web server.

In PHP, compile-time configuration option --enable-force-cgi-redirect and runtime configuration directives doc_root and user_dir can be used to prevent this attack, if the server document tree has any directories with access restrictions. See below for full the explanation of the different combinations.




From this, the doc_root setting in the PHP ini file is NOT the one that you get from $_SERVER (or $HTTP_SERVER_VARS on older versions of PHP).

e.g.

On my system, doc_root is blank, but $_SERVER['DOCUMENT_ROOT'] is set.

NOTE: DOCUMENT_ROOT, not doc_root. Difference.

Richard.

Hi, still working thru your comments but I wanted to clarify something.

You mentioned the PHP.ini:  doc_root = c:\inetpub    // for IIS/PWS

My docs (I have several sites) are located at:

c:\inetpub\wwwroot\[site folder]

In this case:

c:\inetpub\wwwroot\PHP_Stuff


???

if
$doc_root=c:/Inetpub/wwwroot/PHP_Stuff
and
you want to open:
$doc_root\Orders\orders.txt

don't mix slash and backslash!!

try
str_replace("/","\\",$doc_root)\Orders\orders.txt

DON'T USE DOC_ROOT!!!!

doc_root is an internal setting to control where files are allowed to be used when in safe mode.

PLEASE use $_SERVER['DOCUMENT_ROOT']

Richard.

If you are not sure what I mean ...

<?php
error_reporting(E_ALL);

echo "This is what you are trying to get from doc_root : {$_SERVER['doc_root']}\n";
echo "This is what you are trying to get from doc_root : {$HTTP_SERVER_VARS['DOC_ROOT']}\n";

echo "This is what you are REALLY looking for : {$HTTP_SERVER_VARS['DOCUMENT_ROOT']} or {$_SERVER['DOCUMENT_ROOT']}\n";


$_SERVER is for V4.1+ of PHP and is now the preferred method.

$HTTP_SERVER_VARS is the old method and may no longer exist in V5.

Richard.

doc_root is a variable defined in php.ini, I guess you cannot access it through the script.
you can access the $_SERVER['DOCUMENT_ROOT'] or $HTTP_SERVER_VARS['DOCUMENT_ROOT'] which would be 'c:\\inetpub\\wwwroot'.

so that would work for you:
$DOCUMENT_ROOT = $_SERVER['DOCUMENT_ROOT'];
$fp = fopen("$DOCUMENT_ROOT/PHP_Stuff/Orders/orders.txt", 'a');

in fact, you don't even need to know the DOCUMENT_ROOT.
"/PHP_Stuff/Orders/orders.txt" would also do.

jimme. Only repeating for the gazillionth time!!!!

sorry. 2 dumb 2 read ;-)

But reinforcement is always a good thing!

Ok, I see. I got some results now to report back.

I tried doing:

 $fp = fopen("$DOCUMENT_ROOT/Orders/orders.txt", 'a');

and

 $fp = fopen("$DOCUMENT_ROOT/PHP_Stuff/Orders/orders.txt", 'a');

with $DOCUMENT_ROOT = $_SERVER['DOCUMENT_ROOT']; and

$DOCUMENT_ROOT = $HTTP_SERVER_VARS['DOCUMENT_ROOT'];

still got the error. So I just hardcoded the stupid path:

$fp = fopen("c:/Inetpub/wwwroot/PHP_Stuff/Orders/orders.txt", 'a');

and I got it to write the order info to the file. :)

I'm still getting this msg though:

PHP Notice: Undefined index: DOCUMENT_ROOT in c:\Inetpub\wwwroot\PHP_Stuff\chapter01\vieworders.php on line 3

Line 3 = DOCUMENT_ROOT = $HTTP_SERVER_VARS['DOCUMENT_ROOT'];


???

If your Line3 in your code matches the one you posted, i got the error.

you forgot the $ :
Line 3 = $DOCUMENT_ROOT = $HTTP_SERVER_VARS['DOCUMENT_ROOT'];

the result is that your $DOCUMENT_ROOT variable won't be defined.

Maybe you should just try to print your $DOCUMENT_ROOT out to see if it is set correctly:

$DOCUMENT_ROOT = $HTTP_SERVER_VARS['DOCUMENT_ROOT'];
echo $DOCUMENT_ROOT;

check also phpinfo() for the system variable.
(search for DOCUMENT_ROOT in the page printed out by phpinfo())

by the way, which version of php do you have?

Yeah, it was a cut&paste error - my code has:

 $DOCUMENT_ROOT = $HTTP_SERVER_VARS['DOCUMENT_ROOT'];

When I echo the value with:

<?php
  //create short variable name
  $DOCUMENT_ROOT = $HTTP_SERVER_VARS['DOCUMENT_ROOT'];

?>
<html>
<head>
  <title>Holly's Auto Parts - Customer Orders</title>
</head>
<body>
 echo $DOCUMENT_ROOT;
<h1>Holly's Auto Parts</h1>
<h2>Customer Orders</h2>

I just see (literally):

echo $DOCUMENT_ROOT;  on the webpage.  :0





I don't have  $DOCUMENT_ROOT in my phpinfo() - just DOC_ROOT as mentioned above. (?)

Can you cut and paste the ENTIRE page of results from phpinfo(); please.

You should NOT be looking in the PHP Core section (the first configuration part), but in the PHP Variables section (the last configuration part) for DOCUMENT_ROOT or whatever your server says the document root is.

DOCUMENT_ROOT is what Sambar Server and Apache call it. IIS may decide to call it something totally different. Why? Because Microsoft do not know how to spell C O M P A T I B I L I T Y. (And I had to check that twice otherwise the point would not be so important!).

Mine reads ...

_SERVER["DOCUMENT_ROOT"] /home/xxxxxxxx/public_html

So, $_SERVER['DOCUMENT_ROOT'] === '/home/xxxxxxxx/public_html'

Richard.

If you have ...

$array['indexname']

and you get 'Undefined index', then the indexname you are using does NOT exist for the array.

So, your indexname may be case sensistive, or not set or mis-spelled.

Richard.

Here's my PHPINFO page archived at:

http://globalwm.net/exchange/phpinfo.htm

Just to explain ...

$DOCUMENT_ROOT = substr($_SERVER['PATH_TRANSLATED'],0,strlen($_SERVER['SCRIPT_NAME']) * - 1);

The substr() function is going to return a part of $_SERVER['PATH_TRANSLATED'].

The part starts at the beginning of the string (the 0 in the substr()) and stops x number of characters short.

x is the length of the $_SERVER['SCRIPT_NAME'] (I suppose you could also use $PHP_SELF). The * - 1 provides a negative length and this, to substr() means drop this number of letters from the end of the string.


NOTE the line at the end  ...

$rest = substr("abcdef", 0, -1);  // returns "abcde"

From the PHP manual.

substr
(PHP 3, PHP 4 )

substr -- Return part of a string
Description
string substr ( string string, int start [, int length])


substr() returns the portion of string specified by the start and length parameters.

If start is non-negative, the returned string will start at the start'th position in string, counting from zero. For instance, in the string 'abcdef', the character at position 0 is 'a', the character at position 2 is 'c', and so forth.

Example 1. Basic substr() usage

<?php
$rest = substr("abcdef", 1);    // returns "bcdef"
$rest = substr("abcdef", 1, 3); // returns "bcd"
$rest = substr("abcdef", 0, 4); // returns "abcd"
$rest = substr("abcdef", 0, 8); // returns "abcdef"

// Accessing via curly braces is another option
$string = 'abcdef';
echo $string{0};                // returns a
echo $string{3};                // returns d
?>
 
 

If start is negative, the returned string will start at the start'th character from the end of string.

Example 2. Using a negative start

<?php
$rest = substr("abcdef", -1);    // returns "f"
$rest = substr("abcdef", -2);    // returns "ef"
$rest = substr("abcdef", -3, 1); // returns "d"
?>
 
 

If length is given and is positive, the string returned will contain at most length characters beginning from start (depending on the length of string). If string is less than start characters long, FALSE will be returned.

If length is given and is negative, then that many characters will be omitted from the end of string (after the start position has been calculated when a start is negative). If start denotes a position beyond this truncation, an empty string will be returned.

Example 3. Using a negative length

<?php
$rest = substr("abcdef", 0, -1);  // returns "abcde"
$rest = substr("abcdef", 2, -1);  // returns "cde"
$rest = substr("abcdef", 4, -4);  // returns ""
$rest = substr("abcdef", -3, -1); // returns "de"
?>
 
 

That was it! I needed to define as:

$DOCUMENT_ROOT = substr($_SERVER['PATH_TRANSLATED'],0,strlen($_SERVER['SCRIPT_NAME']) * - 1);


since I'm not using Apache.

As soon as I did this, no errors on the order processing page.  :)

First thanks for the points.

Second, your script will work on your IIS server, but if you port this to a Unix platform, you will need to re-check what $_SERVER vars you have available.

Regards,

Richard.

This works on both NIX and WIN

http://".$_SERVER['SERVER_NAME']."".dirname(str_replace("\\\\", "/", $_SERVER['SCRIPT_NAME']))."/index.php

just tips
:-)
www.vision.to