Re: Security in included PHP files
| From: | Philippe Saladin | Date: | Thu, 16 Jan 2003 16:24:27 +0000 |
| Subject: | Re: Security in included PHP files | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-131889@lists.php.net to get a copy of this message | ||
> directly. My main question is if all of the code inside an included PHP
file
> is put inside one or more functions this should prevent anyone from
running
> any of that code by directly calling that PHP file correct? There is no
way
> for them to invoke a function just from a URL assuming I have no code at
all
> outside the functions.
Just a small tip : to be *sure* that no one runs directly my included files,
they begin with
if (basename($_ENV["SCRIPT_NAME"]) != 'index.php') {
// redirection
}
So, even if the code is not in a function or class, I'm safe.
Am I wrong or do you think it could be ok?
Regards,
Philippe