Hey!

How can i make my included files 100% safe.

Like if I include a file witht his code..



How can i make it 100% safe? I know I must close the php tags in the included files. but what more =?

What do you mean by safe?

No one can view the code, or even know that they excist. that should be enough.

This post has been edited by Feelay: Mar 9 2008, 04:50 PM

No one can actually view your php file in the first place. Unless you mistakenly configure the server to serve php pages as html, then it would just display them as plain text. Other wise, no way.

The other thing is, most server serve the include folder above the www/html root, thus making it only visible to the code, but no way to access it from the outside world.

I'm no expert, but surely a simple check to see if the include is being accessed from another page on your site would be enough? If so, just define a variable at the start of the script in which you use the include. Then, in the included file, check that whatever variable you used is defined, and if not simply die() (i.e. don't process the script). Possible error messages would include "This file cannot be directly accessed!" or the like.

Anything wrong with this method of doing things?

I'm not 100% sure but you can use the define and defined php functions for securing your include files, first define a constant in the caller page and then verifiy if it is defined in the include file.

Caller File:

Included File (includefile.php):

EDIT:

• The solution given by faulty.lee is another good one.
• You can use session variables.
• The code that i post was taken from this topic A Simple Checking & Validation PHP Script check it out for more information about this solution.

Best regards,

This post has been edited by TavoxPeru: Mar 12 2008, 10:16 PM

*nods* That'd be the way I described above, but in code format. One point to bear in mind is that you'd need to define the access code once only per page (if you have more than one include). I doubt it would hurt to define it more than once, but it's just messy coding in my opinion.

it really ccompicated but easy if you know how get someone you know to help you out make sure you know what your doing

Well, I realize that this dicussion may be resolved but I figured it couldn't hurt to provide the information anyway.

There actually is a tutorial about the suject on the forums:
CMS103 - Securing Your Website, Keeping your included files from being accessed directly.

Actually, I see that Feelay has read the article already.

Anyway, it discusses this situation.

One additional security measure for your files is to prevent them from being seen altogether. Basically, do not allow anyone to view the files in a given directory. As most of you know, on most servers if there isn't and index file (index.html) then the server makes a nice directory listing of every file on that folder! To prevent this, you can change you server setting or simply add a blank index.html file to EVERY folder on your server.

If you want to get creative, you could use the following index.html file instead:


Alternately, you could simply add the following to the .htaccess file in the parent directory of the folders you do not want to show indexes on:



Hope this helps,
vujsa

Thanks Vujsa
And yes. I remebered that I had read your topic, when I saw TavoxPeru's post