PHP: Using cURL if allow_url_fopen is not enabled

In case you’re using PHP to retrieve data from a certain server you probably came across the problem that it may work for you but a client complained about lots of errors. It’s pretty likely that you’ve relied on the fact that allow_url_fopen is set to true. This way you can put pretty much anything – local path or a URL – into function calls like include or maybe simplexml_load_file.

If you’d like to get around this problem you can advice your client to make the necessary changes in his php.ini file. Most of the time this isn’t an option because the hosting company decided to disable this feature for security reasons. Since almost everybody got cURL installed we can use this to retrieve data from another web server.

Implementation

I’ll present a wrapper that helps you loading an XML file. It uses simplexml_load_file if allow_url_fopen is enabled. If this feature is disabled it employs simplexml_load_string and cURL. If none of this works we’ll throw an exception because we weren’t able to load the data.

class XMLWrapper {
 
  public function loadXML($url) {
    if (ini_get('allow_url_fopen') == true) {
      return $this->load_fopen($url);
    } else if (function_exists('curl_init')) {
      return $this->load_curl($url);
    } else {
      // Enable 'allow_url_fopen' or install cURL.
      throw new Exception("Can't load data.");
    }
  }
 
  private function load_fopen($url) {
    return simplexml_load_file($url);
  }
 
  private function load_curl($url) {
    $curl = curl_init($url);
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
    $result = curl_exec($curl);
    curl_close($curl);
    return simplexml_load_string($result);
  }
 
}

The code is pretty simple, create an instance of the given class and call the loadXML method. It’ll call the right private method which finally loads the XML. Loading some XML is just an example, you can use this technique with e.g. include or require too.

Conclusion

In case allow_url_fopen isn’t enabled it’s easy to write code that works around this problem. This way clients tied to a hosting company with tight security constraints will be able to use your software. If the aforementioned solution doesn’t work because cURL isn’t installed either you can still decide to package the data – that would otherwise be downloaded – along with your module if that’s possible.