Protecting the Included PHP File

Anon

For example I have a file name index.php:

This file is index.php

echo "Hello World!<br>\n";
include("SomeFile.php");
?>

Another file:

This file is SomeFile.php

echo "This is the included part.";
?>

I want people to see the included part within index.php, but I don't want people typing SomeFile.php and see the things inside. How can I prevent people from going directly into SomeFile.php?

Thanks

Anon

A couple of things immediately come to mind.

One is to use includeable files only for functions (and perhaps configuration of global variables). The server will load and parse them but never execute the code, since the functions are not invoked.

Another is to put something like this at the top of an includeable file:

<?
if (basename($PHP_SELF) == "include.php")
header("Location: /404.html");
?>

Anon

Perhaps someone can tell us if putting the included file outside the web document tree is safe or not?

For files I do not want the users to be able to get to by typing in but still let other php scripts access - I have been putting them above the web server and referencing the complete file path.

if my webtree was like
/home/public_web/

my include statement would look like
include("home/thefile.php");

Anon

That's the best way to do it. It stops people from viewing the file in any way, but you can include it in any file.

Any include files with passwords or configuration information should be included this way.

---John Holmes...

Anon

You mean don't have any output in your include files, right? That way even if anyone types in the name, they'll get a blank screen.

And then Joseph will say, well I want to show this html form or table or whatever and I just want to include it.

Well, make showing the table or form a function and just include the file at the top of your index.php page, then call the function wherever you want the table or form to show up.

I think the code is easier to follow like this anyways and keeps it more modular.

---John Holmes...