Re: include()
| From: | Peter Bottenberg | Date: | Thu, 01 Aug 2002 08:21:48 +0000 |
| Subject: | Re: include() | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-110639@lists.php.net to get a copy of this message | ||
Maybe you could create an include directory outsite the root of your
webpage,
like this
<Website Name>
<include> <-- Here are your inlcude files
<HTDocs> <-- Here is yourwebsite
then use:
include "../include/<include filename>";
In this way, the only scripts that have acces to these files are the files
located on the website.
so no other sites, and users on the same server, can include these files.
Peter
"Lord Loh." <lord_loh@rediffmail.com> schreef in bericht
news:20020801052809.39493.qmail@pb1.pair.com...
> I suppose include() can be used to include files from remote systems(not
on
> WINDOWS).
>
> So, How can I protect my script from unauthorised inclusions ?
>
> A webmaster on the same server can always use a path like
> "/home/htdocs/.../config.php" and include my config .php which contains my
> database password !!
>
> Even a web master from a remote server can do the same by probably using
> http://www.xyz.net/config.php
>
> I am using windows 2000/apache/php so I really have not tried these...but
> the docs say it can be done(remote system inclusion except on win)
>
> Lord Loh.
>
>