note 103011 deleted from function.include by googleguy

Note Submitter: Bob Jones ---- include() when used to load configuration information has a scary security flaw, if someone corrupts the PHP header in the included file it will happily print the config file to every page which includes it as plain text. Luckily there is a quick and easy workout for this behaviour (which is alluded to in this article): <?php ob_start();//Hook output buffer include("config.php"); ob_end_clean();//Clear output buffer ?> This will stop the included file from being printed as plain text but also stops you using echo or other print commands from within the included file. It is only appropriate when loading configuration information. I'd recommend doing this whenever you pick up database usernames and passwords from a *.php. It only takes a single wrong character to show everyone in the world that information.