How To Protect Included Files

Feelay

Mar 9 2008, 02:12 PM

Hey!

How can i make my included files 100% safe.

Like if I include a file witht his code..

CODE

include "bla.php";

How can i make it 100% safe? I know I must close the php tags in the included files. but what more =?

Comment/Reply (w/o sign-up)

faulty.lee

Mar 9 2008, 04:07 PM

What do you mean by safe?

Comment/Reply (w/o sign-up)

Feelay

Mar 9 2008, 04:49 PM

No one can view the code, or even know that they excist. that should be enough.

Comment/Reply (w/o sign-up)

faulty.lee

Mar 9 2008, 05:19 PM

No one can actually view your php file in the first place. Unless you mistakenly configure the server to serve php pages as html, then it would just display them as plain text. Other wise, no way.

The other thing is, most server serve the include folder above the www/html root, thus making it only visible to the code, but no way to access it from the outside world.

CODE

yourroot/www/your html files --> http://yourserver/index.tml
yourroot/cgi-bin <-- No way to see this from outside, unless you can actually do this, (http://yourserver/../cgi-bin) which is not possible

Comment/Reply (w/o sign-up)

Mordent

Mar 9 2008, 06:42 PM

I'm no expert, but surely a simple check to see if the include is being accessed from another page on your site would be enough? If so, just define a variable at the start of the script in which you use the include. Then, in the included file, check that whatever variable you used is defined, and if not simply die() (i.e. don't process the script). Possible error messages would include "This file cannot be directly accessed!" or the like.

Anything wrong with this method of doing things?

Comment/Reply (w/o sign-up)

TavoxPeru

Mar 12 2008, 12:12 PM

I'm not 100% sure but you can use the define and defined php functions for securing your include files, first define a constant in the caller page and then verifiy if it is defined in the include file.

Caller File:

CODE

<?php
define( "MY_ACCESS_CODE", true );
include("includefile.php");
?>

Included File (includefile.php):

CODE

<?php
defined( 'MY_ACCESS_CODE' ) or die( 'Direct Access to this location is not allowed.' );
?>

EDIT:

The solution given by faulty.lee is another good one.
You can use session variables.
The code that i post was taken from this topic A Simple Checking & Validation PHP Script check it out for more information about this solution.

Best regards,

Comment/Reply (w/o sign-up)

Mordent

Mar 12 2008, 05:29 PM

QUOTE(TavoxPeru @ Mar 12 2008, 12:12 PM)

CODE

<?php
define( "MY_ACCESS_CODE", true );
include("includefile.php");
?>

Included File (includefile.php):

CODE

<?php
defined( 'MY_ACCESS_CODE' ) or die( 'Direct Access to this location is not allowed.' );
?>

Best regards,

*nods* That'd be the way I described above, but in code format. One point to bear in mind is that you'd need to define the access code once only per page (if you have more than one include). I doubt it would hurt to define it more than once, but it's just messy coding in my opinion.

Comment/Reply (w/o sign-up)

Dizzy

Mar 12 2008, 07:18 PM

it really ccompicated but easy if you know how get someone you know to help you out

make sure you know what your doing

Comment/Reply (w/o sign-up)

vujsa

Mar 15 2008, 10:14 AM

Well, I realize that this dicussion may be resolved but I figured it couldn't hurt to provide the information anyway.

There actually is a tutorial about the suject on the forums:
CMS103 - Securing Your Website, Keeping your included files from being accessed directly.

Actually, I see that Feelay has read the article already.

Anyway, it discusses this situation.

One additional security measure for your files is to prevent them from being seen altogether. Basically, do not allow anyone to view the files in a given directory. As most of you know, on most servers if there isn't and index file (index.html) then the server makes a nice directory listing of every file on that folder! To prevent this, you can change you server setting or simply add a blank index.html file to EVERY folder on your server.

If you want to get creative, you could use the following index.html file instead:

CODE

<html>
<head>
<title>You Aren't Allowed Here!</title>
</head>
<body>
Yeah, like we were just going to let you look around and try to see all of our super secret files and image!<br />
Not to worry, they all look a lot better when viewed through the main page: <a href="domain.com/index.php">Main Page</a>
</body>
</html>

Alternately, you could simply add the following to the .htaccess file in the parent directory of the folders you do not want to show indexes on:

CODE

Options -Indexes

Hope this helps,
vujsa

Comment/Reply (w/o sign-up)

Feelay

Mar 15 2008, 10:43 AM

Thanks Vujsa

And yes. I remebered that I had read your topic, when I saw TavoxPeru's post

Comment/Reply (w/o sign-up)

Similar Topics

Keywords : Included Files

Magic Quotes And $_files - (3)
How Do I Create And Write To Files? - creating, writing, deleting files (4)
Hi, Can someone please tell me how to create files and write to them in PHP. I just want to create
a simple file containing text, and then be able to read it or update it. Thanks Alfie...

Php : Variables Included Dont Work In Functions - Variables from Included files dont work (4)

Today, I came up with this strange PHP behaviour. Just wanted to know if anyone has any
suggestions! I make a common variable/function file called config.php. I put in my generally used
functions in it. Suppose this is my file CODE // -----VARIABLES --- // $a=10,$b.... //
-----FUCTIONS--- // function doit() { print "A value is " . $a; } ?> Here, suppose we execute
this file directly. Since A has a global scope, it does work perfectly. But if this same file is
imported in another file say, mainfile.php CODE // -----VARIABLES --- // $c,$d.... include &#...

Reading Files And Folders - (1)

I am in the process of writing a small content management system for my niche sites and need to be
able to accomplish the following two items. Any assistance would be appreciated: I have a
directory that has nothing but sub directories in it and I need to be able to identify each
directory name and return them in an option drop down selection menu which will be included in an
identifying URL. ALSO: I am in need of a script that could be included on a returned page
that will read the content of a table and identify various keywords within the content and pl...

Php File Upload - About uploading files through php (3)

Right i have done a check for a tutorial on this as well as a question about it but php is not
allowed in the search box. So i thought i'd just ask what i want to know. I have a form which
uploads a file, it refreshes the page, uploads the file and then alerts the user to if the file has
uploaded. To be honest im not sure why i keep getting the error. But here is the code: This is the
form that is used for the user to select the file &fid= " method="POST"> Choose a file to
upload: This is the upload code if ($op == "up"...

Help To Transfer Files Within Hosting Space Using Php - (4)

I want to transfer files from one folder to another or an entire folder in my web space. I don't
want to download it and upload it, can I do this using a PHP script. Please help me. I'm just
learning the basics of PHP...

How To Edit Php Files? - (16)

Hi, You can use frontpage to preview HTML files, but how can I edit and preview PHP files offline.
I'm not well-known with PHP and I see more and more using this script to manage their site....

How To Delete Files When Session Ends - (4)

Dear Friends I need solution to a problem. The problem is as under: I am creating certain files
(playlist) in server disk when user selects some songs. The files are created in ram format. What I
want to do is to delete these files created during a particular session. Is it possible to do so?
Now I am deleting these files using on Unload event fired by JavaScript. I am using PHP. ...

Deleting Files With PHP - is this possible? (6)

It is posible for PHP to delete files on a server? If so, how is this possible? Just out of
interest......

Getting Files From Other Sites - Using wget (3)

Hello. A while ago, a friend showed me this PHP code (wget) which allows you to get files from other
sites. I was a simple one liner type thing. Since my old host (Nytka) went down, I've lost it,
as has my friend. Do you know anything about wget, and could tell me it?...

Looking for protect, included, files