Re: why so slow?
| From: | Jon Anderson | Date: | Fri, 03 Nov 2006 19:12:09 +0000 |
| Subject: | Re: why so slow? | ||
| References: | 1 2 3 4 5 6 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-244169@lists.php.net to get a copy of this message | ||
Richard Lynch wrote:
On Thu, November 2, 2006 3:01 pm, Alan Milnes wrote:jonDon't call files .inc - call them .inc.php if you really must have the inc somewhere, that way the Web Server will actually treat it as a php file and not display your details to the world if accessed directly.A Bad Guy can surf to them, and your PHP code gets executed completely out of context, which you have never ever ever done any QA work on to see what effect that would have... Or, you could put your .inc files outside the web tree, and set http://php.net/include_path correctly, and then the Bad Guy cannot surf to them at all. And you can name them .inc or .class or .dingdongthewickedwitchisdead for all the difference it will make from a technical stand-point. IMHO, the second option is much better. Or you can .htaccess "Deny From All" them out... That's my preferred solution. It keeps the include tree near the code that accompanies it without risking anything even if they're called *.php.