Re: Is there a way to...

On Sat, 16 Oct 2004 22:04:33 -0400, Gh <GaryHotko@gmail.com> wrote:

Your right, this is not what I was expecting, I was thinking there was another way... Sounds good.. but any other suggestions? On Sat, 16 Oct 2004 21:40:56 -0400, Minuk Choi <choi.minuk@verizon.net> wrote:

well, this is probably not what you were expecting... but you can try this admin_template.php -- $parent = true; include('important.php'); -- important.php -- if (!isset($parent) || !$parent) exit(); //important stuff here. -- Of course, this only works assuming that the would-be hacker doesn't know HOW you are authenticating the file. If you are going to try this method, mix it up, use a rather unique variable name and or use a value that is hard to guess. -Minuk ----- Original Message ----- From: "GH" <GaryHotko@gmail.com> To: "PHP General" <php-general@lists.php.net> Sent: Saturday, October 16, 2004 9:15 PM Subject: [PHP] Is there a way to...

Is there a way to make sure that a page is only loaded via a require or include statement? or other type of SSI? I would like to make sure that a 'parent document' (namely admin_template.php) only calls the php file? Thanks

I often do it this way: main.php: <? define('MyScript', '1.0'); include('file.php'); ?> file.php: <? if (!defined('MyScript')) die("Access denite"); ?> To hack this, the attacker needs filesystem access to your script - an if this happens, that should be your smallest problem...