note 50205 deleted from function.pg-connect by bjori
| From: | bjori@php.net | Date: | Tue, 12 Dec 2006 08:51:02 +0000 |
| Subject: | note 50205 deleted from function.pg-connect by bjori | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-120533@lists.php.net to get a copy of this message | ||
Note Submitter: sigve at wolfraidah dot no
----
Regarding Helio Ferenhof's comment above:
That practice may be extremely dangerous, because (at least) Apache doesn't have any special
handle for *.inc files. When they are included into your PHP-script, it works fine, but if you enter
the filename in a web browser's address field you will get the contents of the file dumped as
cleartext - including the username and password!
This can be remedied by a) renaming the include file to .php, b) adding a .htaccess directive which
hides the .inc-files, or globally handle .inc files with php in apache.conf (not recommended, I
guess).