note 103011 added to function.include

include() when used to load configuration information has a scary security flaw, if someone corrupts the PHP header in the included file it will happily print the config file to every page which includes it as plain text. Luckily there is a quick and easy workout for this behaviour (which is alluded to in this article): <?php ob_start();//Hook output buffer include("config.php"); ob_end_clean();//Clear output buffer ?> This will stop the included file from being printed as plain text but also stops you using echo or other print commands from within the included file. It is only appropriate when loading configuration information. I'd recommend doing this whenever you pick up database usernames and passwords from a *.php. It only takes a single wrong character to show everyone in the world that information. ---- Server IP: 69.147.83.197 Probable Submitter: 82.19.157.74 ---- Manual Page -- http://www.php.net/manual/en/function.include.php Edit -- https://master.php.net/note/edit/103011 Del: integrated -- https://master.php.net/note/delete/103011/integrated Del: useless -- https://master.php.net/note/delete/103011/useless Del: bad code -- https://master.php.net/note/delete/103011/bad+code Del: spam -- https://master.php.net/note/delete/103011/spam Del: non-english -- https://master.php.net/note/delete/103011/non-english Del: in docs -- https://master.php.net/note/delete/103011/in+docs Del: other reasons-- https://master.php.net/note/delete/103011 Reject -- https://master.php.net/note/reject/103011 Search -- https://master.php.net/manage/user-notes.php