Hi

I was told before that having the flat file as a php file wouldn't help if it was unparsed but I thought that parsing it wrongly might add protection. I did some tutorials on how to get the flat file open and into an array and came up with this code:

First of all, make the file "read.php" (or whatever you like)

<?

$Lines = file("data.php");

foreach($Lines as $Key => $Val) 
{
   $Data[$Key] = explode("|", $Val);
}

for($K = 0; $K < 1; $K++) {

echo ''; 

}


for($K = 1; $K < sizeof($Lines); $K++) 

{ 
   echo '<p>';   

   echo 'info: '.$Data[$K][0].'<br>';
   echo 'moreinfo: '.$Data[$K][1].'<br>';
   echo '</p>';
}


?>

You can see that the file that is being opened is called data.php

Here is data.php

<?php|phpdata
data1|data2
data3|data4

When you run read.php it will omit the "<?php|phpdata" line and read the rest of the lines.

When you try and directly access data.php you will get an error.

I'd appreciate your feedback to see whether this is a viable security option.

    Why do you need the give the file a .php extension and start it with <?php?

    What you're doing is a CSV file except using vertical bar as a seperator rather than comma. There is a PHP function which helps with this [man]fgetcsv[/man].

    In terms of security, why not just leave the CSV file outside of your document root?

      Using .php as an extension for your data file to prevent web clients from fetching it, is perverse in the EXTREME.

      Put it either outside the web root, or in a directory in which web clients are forbidden (For example, using .htaccess if you're on Apache)

      Mark

        6 days later
        MarkR wrote:

        Using .php as an extension for your data file to prevent web clients from fetching it, is perverse in the EXTREME.

        Put it either outside the web root, or in a directory in which web clients are forbidden (For example, using .htaccess if you're on Apache)

        Mark

        that is, for the case of proprietary code, if it is the case of a distribution code, we don't know if the person who gets it will have either option available, and he did't specify what is he doing with it

          Write a Reply...