RE: [PHP] Security of PHP code

Adrian Ciutureanu pressed the little lettered thingies in this order... > Here is something that happend to me: I forgot to tell Apache that .inc > files must be parsed by PHP. All works fine if you include a .inc file, but > if somebody guess .inc file name, he can see the content of that file! > If this is a concern, either name your include files with a valid PHP extension (i.e. ".php") or add the following line to an .htaccess file: AddType application/x-httpd-php .inc This will make the web server treat your .inc files as though they were PHP files and the source would be parsed rather than shown when accessed through a web browser. > > -----Original Message----- > > From: David A Dickson [mailto:daviddickson@lycos.com] > > Sent: 4 iulie 2001 16:43 > > To: php-general > > Subject: [PHP] Security of PHP code > > > > > > Is it possible for others to view the php code for pages I > > have written? I thought I heard someone say before that they > > could write a simple script to accomplish this. If anyone > > knows of any tacticts people might use to attack my code > > please post them hee. > > > > : David A. Dickson > > : daviddickson@lycos.com Anyone who has access to the server on which your server is hosted can view the source of your site by using the show_source() or highlight_file() functions unless your hosting provider disables those commands. It doesn't really take a "simple script," just a simple function: <? show_source("/path/to/your/file.php"); ?> To make matters worse, most hosting providers fail to chroot jail logins (a chroot jailed login cannot traverse the directory structure UP from its own home directory). This common, but poor policy allows anyone with access to the same server as yours to view your files through the shell or even download them by FTP. They may not overwrite your files, but they CAN view them. There are two solutions if this is an important issue to you: 1) Get a dedicated server. This is kind of spendy, but accomplishes the goal. 2) Only do business with providers that will (even if you have to request it) disable these commands AND chroot jail all logins. Have fun... Christopher Ostmo a.k.a. tech@AppIdeas.com AppIdeas.com Meeting cutting edge dynamic web site needs For a good time, http://www.AppIdeas.com/