[RESOLVED] Secure includes - also path question

Dolemite50

Hi,

I am trying to consolidate all of my includes and I read that it was a good idea to store them outside of the www folder. I put them into a folder above the www dir and can access them fine from the root using ../dir, but sometimes they will need to be called from various levels deep so I'm trying to find the reverse equivelent to
$inc_path = $_SERVER['DOCUMENT_ROOT'] . "/dir"
so that I could target the home/name/dir directory from anywhere.

Also, is this technique a good idea? Are there any good security steps I should know about for includes?

Thanks

NogDog

You might consider changing your PHP configuration to add that directory to your include_path. Then you could include the file simply by its filename. If running on Apache, you can set this via a .htaccess file in your root web directory, something like:

php_value include_path .:/home/your_account/include

If that is not the option, you can call it as:

include $_SERVER['DOCUMENT_ROOT'] . '/../includes/filename.php';

Dolemite50

Thanks, that was fast!
BTW, would either of them be considered "more secure" than the other?

NogDog

I don't think there would be a security difference, as the security gain comes from having the includes outside of the directories that are accessible via HTTP.