setting variables for include file

variable values seem to pass to includes on my system...
snoyes solution probably works well.

>I am trying to set some variables before including a file. Essentially what I was trying to do is prevent access to a particular page >using a session variable, but since I am including this file in an IFRAME that will not work.

I use $_SESSION variables in an IFRAME all the time... doesn't cause me any problems in IE or FF.
did you try this?

The problem with :

if($var1=="blah)
  include("file.php");

is that that will still leave file.php able to be accessed directly.

As for the sessions, it seems to be losing the session when I create the IFRAME. All the pages I create a session variable once they login successfully, but if I try to check it in this one page in the IFRAME, it fails everytime.

are you running session_start() at the beginning of your IFRAME page?

   session_start();
    header("Cache-control: private");

is in both the iframe and the included page. Yet if I try to print out $_SESSION['var'] I get nothing.

you can't include("blah.php?var=blah"); cause it is not parsed correctly by the server, you need to include full path like include("http://localhost/site.blah.php?var=blah"); so the php get correctly executed!

then in blah.php

 if ($_GET["blah"] != "blah) { die("ERROR: NOT BLAH!"); }

Alright, here's the mystery. I absolutely love the idea of (basename($_SERVER['PHP_SELF']) == 'file.php') die('Access Denied');
, which is what I was trying to use initially, but even though the file is being included, that statement still gets evaluated as true and kills the page. The other bizarre thing is that even if I access the URL with http://site.com/file.php?var=blah, if I use $var=$_GET['var']; , it still reads nothing. This makes no sense to me at all since I have used the exact syntax on another page and it works fine. Any suggestions as to what is going on here ?

Thanks.

Just to give more details what's going on/not going on Here is the layout :
Page 1:
<IFRAME src=music.php></IFRAME>

Page2 (music.php):

session_start();
header("Cache-control: private");

if(!isset($_SESSION[var]){ die('login');}  // This works fine on this page
$var=blah;
include('file.php');


Page3 (file.php):

 session_start();
 header("Cache-control: private");

echo "var:" .$var; // will print var:   and nothing else
echo "var: "  .$_GET['var']; // same thing

if(!isset($_SESSION['var'])){die('login');} // will kill the page from loading

if instead I try
if (basename($_SERVER['PHP_SELF']) == 'file.php') die('Access Denied'); // also kills the page

The frustrating thing is this EXACt code works on other pages. The only difference is this page is in a different directory, but but no special .htaccess rules have been applied.

Any insight is appreciated.
Thanks in advance.

I figured out the problem. So simple, yet some things still don't quite add up, if someone can explain it I'll give them the points ;).

What it was is the directory structure is kind of messed up, so to simplify it I was using include('http://site.com/path/file.php') , once I used a relative path instead the session was passed fine. I'm assuming that by including http:// it created a new session when it ran file.php, but shouldn't setting $var in the file including the page still be able to be passed ?

Thanks.

All the clues are that little bit too vague to be specific with an answer....

The session problem sounds like it is related to the domain or path setting in the session cookie.

A session will only be available on the domain (and same sub domain) that is was set on unless the domain parameter for the session cookie is set to .domain.com (notice the leading dot). This is what i would expect the cause of the problem to be.

You can read more on the matter in the documentation for the setcookie function (under the parameters section): http://us3.php.net/manual/en/function.setcookie.php

The settings for the session cookie are in the php.ini file under the [SESSION] section.

Just to note, when including files it's easiest to use:

include($_SERVER['DOCUMENT_ROOT'].'/path/from/root/file.php');

That all said, i am unclear as to why the...

if (basename($_SERVER['PHP_SELF']) == 'file.php') die('Access Denied');

approach was not working. If the filename of the current script is file.php (ie. if you access the file directly) it should evaluate as true and die... if the file is included in another file $_SERVER['PHP_SELF'] will return the name of that file and so it should evaluate as false.

I just tested with:

page1.php:
------------------------------------------
<iframe src="page2.php"></iframe>
------------------------------------------

page2.php:
------------------------------------------
<?php
include('page3.php');
?>
------------------------------------------

page3.php:
------------------------------------------
<?php
if (basename($_SERVER['PHP_SELF']) == 'page3.php') die('Access Denied');
?>
hello world
------------------------------------------

page1.php (output): The iframe containing the text "hello world"
page2.php (output): The text "hello world"
page3.php (output): The text "Access Denied"

>> shouldn't setting $var in the file including the page still be able to be passed ?

yes it should, when accessing the file that set the variable, eg:

page1.php:
------------------------------------------
<?php
$var = 'hello world';
include('page2.php');
?>
------------------------------------------

page2.php:
------------------------------------------
<?php
echo "var: $var";
?>
------------------------------------------

page1.php (output): "var: hello world"
page2.php (output): "var:" (with an undefined variable notice error)

As a general note, it sounds like you have the error reporting configured to a lower level... when developing and debugging it is very useful to show ALL errors, this serves two purposes, 1) It will help you identify and solve problems quicker and easier and 2) it will avoid you picking up any bad habits with "notice code" syntax (ie. code that is erroneous but the errors are not shown as a result of the error reporting level).

If you don't want to/can't change the php.ini setting for error_reporting you can simply add: error_reporting(E_ALL); to the top of your scripts.

Diablo84