Protecting required files.

[Anon]

Question:

How do you protect required files from ever being served by the webserver?

Is there an easy way of doing this? The only method I can think of is to include the entire content of a page in an if-statement (or switch) and if a certain variable is set, then deliver the content.

This is easily circumventable however, as one only need to set the variable that triggers the if-statement to be true.

Any ideas?

[jlambert]

I believe also if the filename consists of .inc as the prefix that the webserver will not be served. I could be wrong though, it just seems like something I heard of or something.

[kparker]

Store the include-files outside the web root.

[rrijnders]

You can also put in <DIRECTORY> section for your document root in the access.conf file:

<Files *.inc>
Deny from all
</Files>

which will stop the web server from serving up your include files (provided they have the .inc extension.

-- Rich Rijnders
-- Irvine, CA US

[Anon]

just rename all these files!
if you called them '.inc' just rename them to '.inc.php'. that way, if someone tries to access them directly they will be parsed by the webserver/php and likely cause an error, but in any case the sourcecode will not be visible.
this is a good method if you don't have access to the server-configuration or .htaccess-files.