Hi was wondering if someone could help.

 

Myself and a friend of mine are a little confused as to whether the allow_url_include parameter of the php.ini file uncommented and set to On poses any security threats. As long as the server has been administered with the correct security measures surely it should be ok. But maybe someone here knows more. Thanks in advance

You should take a look at this article and its comments to make up your mind on whether or not you are going to disable it. The fact of the matter is there is no right or wrong answer

http://blog.php-security.org/archives/45-PHP-5.2.0-and-allow_url_include.html

Thanks for the response it is really appreciated. I do understand now how this parameter can cause threats. However, I don't think the server is of interest to any attacker, and correct UNIX security measures are in place. So I guess its ok to keep it on! Thanks again

To be honest I don't see why you would even need to include files from a URL. If they're on the local file system you shouldn't have an issue with including in the first place

Just attempting to learn new things my friend. The one question I am often asking myself is "what does this do?". So I find out, useless or not.

 

Thanks for your help

Fair enough. I've read through the whole php.ini before. It has some interesting comments and features in there that a lot of people would't know about unless they were specifically told about them, so it's worth having a look