note 111722 added to function.exit

As seen below, a useful way to prevent direct enumeration of includes is as follows: <?PHP if (strtolower($_SERVER['SCRIPT_FILENAME'])==strtolower(__FILE__)) { if (!headers_sent()) { header('HTTP/1.1 301 Moved Permanently',true,301); header("Location: http://{$_SERVER['HTTP_HOST']}/"); } die; } echo "The script was accessed via an include/require"; ?> This code contains a few enhancements, notably: - strtolower. In Windows environments, SCRIPT_FILENAME returned "i:/web/file.php", but __FILE__ returned "I:/web/file.php" making it not work. Additionally, added a 301 header to redirect gracefully (and preserve any SEO that you might get on an include ;)) The "L" in "Location" should be capitalized and the path should be absolute per RFC 2616 (check http vs. https for your use case). Finally, as suggested later, die; was added in the case that headers were already sent. It is up to the client to respect the redirection, so the client could disable redirection leading to unintended code execution. Though this is on the "exit()" page, I used die; as a form of habit. Alter as needed. ---- Server IP: 64.71.164.2 Probable Submitter: 208.95.30.82 ---- Manual Page -- http://php.net/manual/en/function.exit.php Edit -- https://master.php.net/note/edit/111722 Del: integrated -- https://master.php.net/note/delete/111722/integrated Del: useless -- https://master.php.net/note/delete/111722/useless Del: bad code -- https://master.php.net/note/delete/111722/bad+code Del: spam -- https://master.php.net/note/delete/111722/spam Del: non-english -- https://master.php.net/note/delete/111722/non-english Del: in docs -- https://master.php.net/note/delete/111722/in+docs Del: other reasons-- https://master.php.net/note/delete/111722 Reject -- https://master.php.net/note/reject/111722 Search -- https://master.php.net/manage/user-notes.php