PHP - Do Sessions Require Https?

Is there a better way to define the page name other than   require("./anyfolder/any.php"); 
trouble is i define the page by using ./myfole/anyfile.php but if  the page is called from deeper inside my site it dose not work. i have to change all the includes and put an additional . so it ends up looking like this ../myfole/anyfile.php
 

Hi Everyone,   I am really struggling with this.....Cannot find a solution anywhere.   I have a website with SSL installed. I would like to force SSL on the whole website but not on 2 urls.   If my whole site is https://mysite.com   and the 2 urls to disable from the SSL a http://mysite.com/hotels http://mysite.com/weather   How can I do it via htaccess please?   Thank you so much,   Ben

I am relatively new to php and am working on a small project for myself where I need to make a secure https connection to my supplier's web server and have to pass a data string to the server using the POST method.

I've googled 'using php to make https connections', but am having difficulty getting started in learning about this process.  The PHP manual is somewhat too 'techie' for my level.

Does anyone have a suggestion where I can get started?

Thanks.

Hi all "im new here"
 
Hoping someone can help me with this peculiar problem.
 
I have a vps running Plesk (9.5.4) + PHP 5.3
 
For the domain I am working on, I have specified additional directories to the PHP include_path via vhost conf file.
 
One of those directories is outside of webroot, so is same level as httpdocs.
  eg:

:/var/www/vhosts/example.com/outer_includes

My scripts are able to include PHP files, using require, include etc from the directory added to PHP's include, so I know that its working perfectly.
 
Problem I have is that if I call a script with HTTPS, I get require_once fatals, as for some reason the includes no longer work.     --------------------------------------------------- eg:   include_me.php lives in a directory on same level as httpdocs, which has been added to PHP include directories.

/var/www/vhosts/example.com/outer_includes/include_me.php

script.php contains:

<?php

require_once('include_me.php');

?>

Calling:   http://www.example.com/script.php   This works as expected.   Calling:   https://www.example.com/script.php   This fails with fatal on the require_once() ---------------------------------------------------
 
I am self taught and fully expect this to be another hole in my knowledge but I can't seem to fill this one by asking Google.
 
Can anyone advise? Would be very grateful
 
Boreas
Edited by Boreas, 02 September 2014 - 04:20 PM.

I am using file_get_contents with a url (http) to screen scrape certain web pages that are publicly accessible.
However there are certain web pages (https) that require me to use an x509 certificate stored in my browser to make them visible.
I would like to scrape them too.

How would I scrape them using a php script?

Thanks in Advance.

Hello I have problem on redirecting the site to https when it comes to "www.site.com".    I made this

 <rules>                  
              <rule name="Redirect site.com to www" patternSyntax="Wildcard" stopProcessing="true">
                     <match url="*" />
                         <conditions>
                              <add input="{HTTP_HOST}" pattern="site.co" />
                         </conditions>
                         <action type="Redirect" url="https://www.site.co/{R:0}" />
               </rule>
</rules>

In this sample when I try to access the site through "site.com" it redirect to " https://www.site.com " but when I access the site to www.site.com the https doesn't appear.  

Apache https setup!   Okay so i made my own SSL certificate for my localhost using these commands   OpenSSL: ( CMD > c:\xampp\apache\bin\openssl )

req -config c:\xampp\php\extras\ssl\openssl.cnf -new -out jobnow.csr -keyout jobnow.pem
rsa -in jobnow.pem -out c:\jobnow.key
x509 -in jobnow.csr -out jobnow.crt -req -signkey c:\jobnow.key -days 369

when asked for common name type your ip address.    Then i install import the certificate to certmgr.msc   Restate Apache   https//192.168.0.14   - Doesnt work 192.168.0.14 - Works fine   Apache error log:

[Wed Sep 10 12:05:41.299000 2014] [ssl:warn] [pid 7840:tid 260] AH01909: RSA certificate configured for localhost:80 does NOT include an ID which matches the server name
[Wed Sep 10 12:05:41.301000 2014] [ssl:warn] [pid 7840:tid 260] AH01909: RSA certificate configured for 192.168.0.14:443 does NOT include an ID which matches the server name
[Wed Sep 10 12:05:41.301000 2014] [ssl:warn] [pid 7840:tid 260] AH01915: Init: (localhost:80) You configured HTTPS(443) on the standard HTTP(80) port!
[Wed Sep 10 12:05:41.373000 2014] [co warn] [pid 7840:tid 260] AH00098: pid file C:/xampp/apache/logs/httpd.pid overwritten -- Unclean shutdown of previous Apache run?
[Wed Sep 10 12:05:41.616000 2014] [ssl:warn] [pid 7840:tid 260] AH01909: RSA certificate configured for localhost:80 does NOT include an ID which matches the server name
[Wed Sep 10 12:05:41.617000 2014] [ssl:warn] [pid 7840:tid 260] AH01909: RSA certificate configured for 192.168.0.14:443 does NOT include an ID which matches the server name
[Wed Sep 10 12:05:41.617000 2014] [ssl:warn] [pid 7840:tid 260] AH01915: Init: (localhost:80) You configured HTTPS(443) on the standard HTTP(80) port!
[Wed Sep 10 12:05:41.659000 2014] [mpm_winnt:notice] [pid 7840:tid 260] AH00455: Apache/2.4.7 (Win32) OpenSSL/1.0.1e PHP/5.5.9 configured -- resuming normal operations
[Wed Sep 10 12:05:41.659000 2014] [mpm_winnt:notice] [pid 7840:tid 260] AH00456: Apache Lounge VC11 Server built: Nov 21 2013 20:13:01
[Wed Sep 10 12:05:41.659000 2014] [co notice] [pid 7840:tid 260] AH00094: Command line: 'c:\\xampp\\apache\\bin\\httpd.exe -d C:/xampp/apache'
[Wed Sep 10 12:05:41.661000 2014] [mpm_winnt:notice] [pid 7840:tid 260] AH00418: Parent: Created child process 7032
[Wed Sep 10 12:05:42.319000 2014] [ssl:warn] [pid 7032:tid 272] AH01909: RSA certificate configured for localhost:80 does NOT include an ID which matches the server name
[Wed Sep 10 12:05:42.321000 2014] [ssl:warn] [pid 7032:tid 272] AH01909: RSA certificate configured for 192.168.0.14:443 does NOT include an ID which matches the server name
[Wed Sep 10 12:05:42.321000 2014] [ssl:warn] [pid 7032:tid 272] AH01915: Init: (localhost:80) You configured HTTPS(443) on the standard HTTP(80) port!
[Wed Sep 10 12:05:42.645000 2014] [ssl:warn] [pid 7032:tid 272] AH01909: RSA certificate configured for localhost:80 does NOT include an ID which matches the server name
[Wed Sep 10 12:05:42.646000 2014] [ssl:warn] [pid 7032:tid 272] AH01909: RSA certificate configured for 192.168.0.14:443 does NOT include an ID which matches the server name
[Wed Sep 10 12:05:42.646000 2014] [ssl:warn] [pid 7032:tid 272] AH01915: Init: (localhost:80) You configured HTTPS(443) on the standard HTTP(80) port!
[Wed Sep 10 12:05:42.688000 2014] [mpm_winnt:notice] [pid 7032:tid 272] AH00354: Child: Starting 150 worker threads.
[Wed Sep 10 12:05:54.589000 2014] [authz_co error] [pid 7032:tid 1652] [client 192.168.0.14:3112] AH01630: client denied by server configuration: C:/xampp/htdocs/
[Wed Sep 10 12:05:54.682000 2014] [authz_co error] [pid 7032:tid 1652] [client 192.168.0.14:3112] AH01630: client denied by server configuration: C:/xampp/htdocs/favicon.ico

It says my server name does not match, So i changed the server name to: ( httpd-ssl.conf ) around line 80 ServerName 192.168.0.14:443 DocumentRoot to my httpd.conf document root     My .key is in apache/conf/ssl.key my crt is in apache/conf/ssl.crt       I hope this helps someone else! i had to post this after how much trouble it was causing me!

It seems to me that this should be easy, but I can't find it in the manual or the on the web, and the values in $_SERVER don't suggest anything.

Context: script A loads script B using HTTPS. Now script B has to load resources (images, style sheets, etc). Browsers often object to HTTP references from a script run by an HTTPS request, so script B should generate URLs that use HTTPS. Thus it has to know that it was loaded with HTTPS.

I can do this by brute force if I have to (defining a "protocol" constant in the script itself), but I'd rather make the test automatic.

Not sure if my title line was worded correctly, but here is what I am trying to understand...

I need to hook my website up to a payment gateway to accept credit cards.

After I package up the customer's payment details and send the payment gateway an XML string, their server supposedly sends back a request for more information OR it indicates a Pass/Fail message.

This is where I am getting lost.

If I send data over HTTPS using POST, then how am I supposed to receive a message back from them?

It's not like we are on the telephone and there is a "live" link between my web server and theirs?!

Can someone please explain how this works?

Thanks,



Debbie

Hi guys.. i am not very sure where to post about this issue but im giving a try and hope to get some ideeas where this might come maybe.

So i have a small website with a members database.. the website itself it has SSL and works properly on a https connection. The problem comes when a member tries to access via http. Unfortunetaly on a page i have to keep it http due to some ads that i display there and dont work on https.

If a member logs in and surfs the website via https everything is working perfectly.. but when he changes and tries to access via http he automatically gets logged out.. if he tries to login via http he also cant and gets an error with an invalid token.

So basically i think my database cant connect when accessed by http..

Any of you ever encountered this issue ? Or maybe have some ideeas where this issue is coming from ?

 

Thanks and any ideea or help very appreciated

I want to make sure that a specific page (login.php) only has stuff from my https and none from my (or other) http sites. How can I do this?

Should I always use HTTPS when users are inputting credit card numbers & billing info? Do you know any sites that don't use HTTPS? I just want to know if it's a total no-no for web applications.

Discuss.

(Trying to get my brain back into this old problem which I fixed but want to re-code a better way...)

So I was having problems with getting some browser error when people would go to checkout because the page logo was coming from an HTTP source and the page was an HTTPS page.

I created a "config" file and had this code...
Code: [Select]
<?php
define('ENVIRONMENT', 'development');
//define('ENVIRONMENT', 'production');

// Secure Web Server Root
define('SECURE_WEB_ROOT', ENVIRONMENT === 'development'
? 'http://local.dev3/'
: 'https://www.mysite.com/');
?>

Then in my page I had...
Code: [Select]
<div id="header">
<a href="<?php echo WEB_ROOT ?>index.php">
<img id="logo" src="<?php echo SECURE_WEB_ROOT ?>images/mylogo_200x50.png"
width="200" alt="My Logo" />
</a>
</div>


Is there a better way to do this and eliminate my Config file which is no longer needed since I learned how to create a "Virtual Server"?


Debbie

Hello.

Include is identical to require, only require stops any further script execution.

Just wondering if anyone could give me a good example, where 'require' should be used instead 'include'.

Thanks.

I've just downloaded a 3d party app and I'm finding that most (98%) of the [files].php have a "<?php" but not a "?>" in them.  I created a tst.php...HW and it seems to not care.  An improvement? Mox-Nix? Poor form? Or the same coder the loves 0xEEE text on a 0xFFF background because it's sooooo cool.   Head @ 42 deg /////   Thanks cal