Security problem with include()?

[phlow]

How can I prevent that someone opens a file directly (by typing its name in the browser) which I only want to use as part of an other document by including it.

[fumagalli]

Make sure the included file(s) has a .php extension (i.e. mystuff.inc.php).

"Casual" viewers will see a blank page (if the included file does not output html) or parts of a web page (if it does output html).

Both ways it is much better that showing the code.

[phlow]

Yes, thats sure. But is there a way to make sure that the script is not executed if it is run directly and that it can only be used for inclusion?

Thanx for your help, Phlow.

[Anon]

Don't keep your includes inside the DOCUMENT_ROOT