Click to See Complete Forum and Search --> : Read or Print PHP Resulting HTML From Perl
lightnb
12-18-2008, 06:44 PM
I'm looking for a command that prints out the result of an executable file.
For example, instead of reading the contents of MyFile.php, it would run it through the PHP interpreter, and read in the HTML output that MyFile.php generated.
It doesn't have to talk to Perl at all, just read in the result. Actually, I don't care if it reads in the result, since I'm not doing anything with it... As long as the result gets printed.
IE:
print "<html><head>";
# print resulting HTML from running MyHeader.php through the PHP interpreter
print "</head><body>";
.......
dragle
12-19-2008, 10:18 AM
I've not used it myself, but this CPAN module looks promising:
http://search.cpan.org/~aff/PHP-Interpreter-1.0.2/lib/PHP/Interpreter.pm
Otherwise, assuming you have the stand alone PHP interpreter installed, see perldoc perlipc, especially the section "Using open() for IPC." Be wary of this second approach; you must be absolutely certain you can trust the command and arguments that you are opening, lest you leave yourself open to potential security breaches...
Another possibility might be to access the Web server and hit the .php file directly using a regular HTTP call, assuming it (the .php file) is available directly. I.E., something like:
use LWP::Simple qw(get);
my $php_guts = get('http://myserver.com/MyFile.php');
Best regards,
Sixtease
12-20-2008, 05:25 AM
Wouldn't it suffice for you to just have the PHP script run? I.E. something like
system('/usr/bin/php myscript.php')
lightnb
12-23-2008, 01:59 PM
Thanks guys...
The get method Dan suggested worked well for cross site script extraction, but your saying that the command "system('/usr/bin/php myscript.php')" would return a string of the PHP scripts output (provided the script was on the same server)?
Sixtease
12-23-2008, 02:28 PM
No, no, system would not return the string output by the PHP script. I thought you wanted to print it out. Calling it via system would let the output go to STDOUT, so you'd not need to print it then in Perl.
Scriptage
12-24-2008, 05:04 AM
Couldn't you just pipe it?
open(PHP, "|myscript.php") || die "Couldn't open myscript.php: $!";
while(<PHP>){
print $_;
}
close(PHP);
dragle
12-24-2008, 10:16 AM
Really a piped open (perldoc perlipc), system (perldoc -f system), backticks (perldoc perlop, see qx/STRING/), or a get (perldoc LWP::Simple) should all do the trick depending on the circumstances; pick the one that feels best to you. As Sixtease pointed out, system will just send the PHP's output to STDOUT, so your Perl script doesn't get to see it; while the other choices will allow you to manipulate the results within your script.
The first three choices will all require that you have the stand alone PHP interpreter installed, which you probably do. Just be very wary of what you're passing to the system shell (I recommend taint mode - perldoc perlsec). In that light, system is probably better expressed as:
system ('/absolute/path/to/php', '/path/to/myscript.php');
to ensure you avoid the system shell altogether (See perldoc perlsec). Or, if the PHP script is setup to execute as a shell script (with a shebang line) you could just provide the scriptname alone without arguments to system (or a piped open). But in my (limited) PHP experience, most PHP scripts don't have shebang lines and therefore need the interpreter to be specified (i.e., /usr/bin/php myscript.php).
See also http://www.w3.org/Security/Faq/wwwsf4.html#CGI-Q14 for more on the topic.
And as I mentioned, the get option requires that the file you are getting is accessible directly through the Web server (which it probably is).
The various documents I referenced in bold should help you to decide which option to choose.