Home/ Questions/Q 6924955
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-27T10:43:41+00:00

Is it possible to include something in PHP without passing the variables that were

  • 0

Is it possible to include something in PHP without passing the variables that were passed to the original script?

I am using Joomla, and I am getting the error documented here (“Illegal Variables …”). The php script is an AJAX script that sends data back to the browser, so this script takes a lot of POST variables, does a database query, then echos the result. I am trying to tighten up security, so I put an include in this script to authenticate the user with the built it Joomla modules. I got the idea from here for the user authentication script.
The authentication script works for some pages, but with others I get the error mentioned above. So I want to include the authentication script without passing any variables to it. Is this possible?

EDIT: Here is a little more detail.

In the ajax script I have this:

<?php
    include '/var/www/joomla-auth.php';
...

below here is the script, basically the “joomla-auth.php” included script takes care of getting the username and password for a mysql query. Contents of joomla-auth:

<?php

define( '_JEXEC', 1 );
define('JPATH_BASE', dirname(__FILE__));
define( 'DS', DIRECTORY_SEPARATOR );
require_once ( JPATH_BASE .DS.'includes'.DS.'defines.php' );
require_once ( JPATH_BASE .DS.'includes'.DS.'framework.php' );

/* Create the Application */
$mainframe =& JFactory::getApplication('site');

/* Make sure we are logged in at all. */
if (JFactory::getUser()->id == 0)
    die("Access denied: login required.");

$user =& JFactory::getUser();

I am pretty sure it is the define or require lines that is throwing the error:

Illegal variable _files or _env or _get or _post or
_cookie or _server or _session or globals passed to script.

As documented in the first link above.

EDIT 2:

The ‘joomla-auth.php’ script makes $username and $password variables which are then used in the AJAX script. I tried this at the top of the AJAX script:

function get_creds(){
    include '/var/www/joomla-auth.php';
    return Array($username,$password);
}

$creds = get_creds();
$username = $creds[0];
$password = $creds[1];
....

But still the $_POST variables are being passed to /var/www/joomla-auth.php 🙁

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Joomla throws this error if you’re passing it one of the vars mentioned in your error to the url (or via mod_rewrite):

    _files or _env or _get or _post or _cookie or _server or _session

    Besides, I think the same error is thrown if you’re passing a whole numeric variable, such as:

    http://yoursite.com/?123456=abc

    Just make sure you’re not passing any of these vars in the url. If you can’t find the problem, try to check what’s in the request before the error is thrown.

    I hope it helped!

    • 0