如何从另一个网站(我控制的)获取代码?

发布于 2024-11-02 13:16:17 字数 149 浏览 3 评论 0原文

我想在我的网站中输入一行 php 并让它回显要在我的网站上输入的代码。本质上,我控制着客户网站的一部分,如果我可以更改它而不要求他们上传它,那么对所有参与者来说会更方便。这肯定是一个长期解决的问题,但我找不到解决方案。另外,我不确定如果我的代码是服务器端这是否可行。想法、帮助、建议?

I want to enter a line of php into my site and have it echo out code that is to be entered on my site. Essentially I am controlling a part of a clients' site and it is more convenient for all involved if I can change it without requiring them to upload it. This must be a long solved issue, but I cannot find a solution. Also, I am not sure if this is possible if my code is server side. Thoughts, help, suggestions?

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(5

生生漫 2024-11-09 13:16:17

我的想法和建议...不要这样做!以下是几个原因:

  1. 安全性:这是最大的
    原因。
  2. 延迟:您的客户网站将
    跑得更慢,因为它必须拉动
    通过网络编写代码,以便
    工作。
  3. 停机时间:当您的
    服务器宕机了?它会降低你的
    客户端服务器可能打开它
    直至攻击。

这个想法的一切都很糟糕。因为你可以做某事和因为你应该做某事之间有一条界限。这绝对是不应该的。

My thoughts and suggestions... don't do it! Here are a few reasons why:

  1. Security: This is the biggest
    reason.
  2. Latency: Your clients website will
    run slower because it has to pull
    code across the net in order to
    work.
  3. Downtime: What happens when your
    server goes down? It takes down your
    clients server possibly opening it
    up to attacks.

Everything about the idea is bad. There is a line between doing something because you can and doing something because you should. This is definitively as SHOULDN'T.

来世叙缘 2024-11-09 13:16:17

您应该找出一种不同的方法来解决这个问题。从我的想法来看,您可能可以编写一个实用程序,允许您使用用户名和密码替换特定文件。

使用其他站点的代码,即使您控制它,也是非常危险的。潜在的攻击者所要做的就是通过多种方式之一欺骗地址,他们实际上可以在服务器上执行脚本有权执行的任何操作。为了完整起见,您正在寻找“eval”,但您想要使用不同的方法。

You should figure out a different approach to fixing this problem. From the top of my head, you could probably write a utility that allows, with a username and password, you to replace specific files.

Using code from another site, even if you control it, is incredibly dangerous. All a would-be attacker has to do is spoof the address through one of many means, and they could literally do anything on the server that the script has privileges to do. For completeness, you are looking for "eval", but you want to use a different approach.

奢望 2024-11-09 13:16:17

你知道,PHP 内置了 FTP 支持。也许您可以编写一个远程部署应用程序。

Y'know, PHP has FTP support built-in. Maybe you could write a remote deployment app.

早茶月光 2024-11-09 13:16:17

这就是创建 ssh 的目的:

ssh user@remotehost 'execute remote command here'

无论实现如何,我都不会在 PHP 中执行类似的操作,因为这是一个巨大的安全漏洞。

This is what ssh was created for:

ssh user@remotehost 'execute remote command here'

I wouldn't do anything like this in PHP no matter the implementation because it is a huge security vulnerability.

孤君无依 2024-11-09 13:16:17

当你说你有 PHP 回显代码到你这边时,我认为它是 php 回显 javascript。这意味着您还可以将 js 打印到不同的文件并链接到它。

例如,服务器上的 php 可能如下所示:

echo "function doCoolStuff(){alert("I am awesome!");}\ndoCoolStuff();";

在客户端页面上,您说

<script src='freelancerssite.com/codeIneed.php'>

这样,客户端始终会获取您服务器上的代码。

When you say you have PHP echoing out code onto your side, I assume it's php echoing out javascript. This means that you can also print out the js to a different file and link to it.

for example, the php on your server could look like this:

echo "function doCoolStuff(){alert("I am awesome!");}\ndoCoolStuff();";

on the client's page, you say

<script src='freelancerssite.com/codeIneed.php'>

This way, the client always gets the code you have on your server.

~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文