Re: how to hide dbconnect file if its in publisheddirectory?

I didn't read the first parts of this thread, but the reason for it working in the first example and not the second is because the web server/php engine process php files when they're called over HTTP. This means that the define() call is being executed, but your primary script only includes what is sent through output. Since there is no output, there is no value to include. You can include("/path/to/local/dir/file.php") and it'll simply include the source code, not the processed output. But anything being called via HTTP will be processed as if you were viewing that file from a web browser. /* Chris Lambert, CTO - chris@whitecrown.net WhiteCrown Networks - More Than White Hats Web Application Security - www.whitecrown.net */ ----- Original Message ----- From: Thomas David Kehoe <kehoe@casafuturatech.com> To: <php-general@lists.php.net> Sent: Tuesday, July 10, 2001 2:37 PM Subject: Re: [PHP] how to hide dbconnect file if its in publisheddirectory? | The suggestion to use the ".php" extension instead of the ".inc" extension | doesn't work. | | I created to identical files, swordfish.php and swordfish.inc, containing | the following script: | | <?php | define("PASSWORD", "swordfish"); | ?> | | When I use the following lines | | include ('http://www.friendshipcenter.com/Objects/swordfish.inc'); | echo "Your password is ", PASSWORD; | | it works, i.e., prints "Your password is swordfish." | | When I use the following lines | | include ('http://www.friendshipcenter.com/Objects/swordfish.php'); | echo "Your password is ", PASSWORD; | | it doesn't work, i.e., prints "Your password is PASSWORD." | | I tried putting swordfish.inc in my "cgi-bin" directory, which is outside my | "www" directory. I can't figure out what pathname to call it with. I.e., | | include ('cgi-bin/swordfish.inc'); | | can't find the file. | | As I wrote earlier, my .inc files can be read by anyone typing in the URL. | It doesn't matter if there are <?php ?> lines. .inc files don't execute. | | I rent server space from phpwebhosting.com, so I can't change the PHP | settings. | | Any other ideas how to hide a password file? | -- | Thomas David Kehoe, author of | "THE EVOLUTION OF INTIMATE RELATIONSHIPS" | How Our Brains Are Hardwired For Relationships | http://www.FriendshipCenter.com/TEIR/ | | | -- | PHP General Mailing List (http://www.php.net/) | To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net | For additional commands, e-mail: php-general-help@lists.php.net | To contact the list administrators, e-mail: php-list-admin@lists.php.net | | |