Question

I am able to manually get the user’s data, but not programatically.

Using the server side code, as it is, from – https://developers.facebook.com/docs/authentication/

 <?php 

 $app_id = "MY_APP_ID";
 $app_secret = "MY_APP_SECRET";
 $my_url = "ADDRESS_OF_CURRENT_PAGE";

 session_start();
 $code = $_REQUEST["code"];

 if(empty($code)) {
   $_SESSION['state'] = md5(uniqid(rand(), TRUE)); //CSRF protection
   $dialog_url = "https://www.facebook.com/dialog/oauth?client_id=" 
     . $app_id . "&redirect_uri=" . urlencode($my_url) . "&state="
     . $_SESSION['state'];

   echo("<script> top.location.href='" . $dialog_url . "'</script>");
 }

 if($_REQUEST['state'] == $_SESSION['state']) {
   $token_url = "https://graph.facebook.com/oauth/access_token?"
   . "client_id=" . $app_id . "&redirect_uri=" . urlencode($my_url)
   . "&client_secret=" . $app_secret . "&code=" . $code;

   $response = @file_get_contents($token_url);
   $params = null;
   parse_str($response, $params);

   $graph_url = "https://graph.facebook.com/me?access_token=" 
     . $params['access_token'];

   $user = json_decode(file_get_contents($graph_url));
   echo("Hello " . $user->name);
 }
 else {
   echo("The state does not match. You may be a victim of CSRF.");
 }

 ?>

The output is only Hello, the user name does not show up!

I think the problem is with the file_get_contents(), as echo-ing $response has no output, where as $token_url has the appropriate value.

   $response = @file_get_contents($token_url);

• PHP version = 5.2.9
• Error reporting is off, but including this in the code – error_reporting(E_ALL); gives no output.

UPDATE – So, I tried this after 6 months, and it worked. The only thing that has changed since then is my hosting. I was using HostBig before. Lesson – Don’t depend on $1/month hosting services, they can’t be trusted.

Answer 1

So, I tried this after 6 months, and it worked. The only thing that has changed since then is my hosting. I was using HostBig before.

There was probably something wrong with HostBig’s PHP configuration, which disabled the file_get_contents().

UPDATE – I talked to the HostBig guys, and they told me that they have disabled allow_url_fopen, for reasons of safety, and suggested cURL as the safer alternative.