note 12133 deleted from function.include by philip
| From: | philip@php.net | Date: | Fri, 02 Nov 2001 07:00:46 +0000 |
| Subject: | note 12133 deleted from function.include by philip | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-20276@lists.php.net to get a copy of this message | ||
In some php program examples, the file to be included is usually with the extendtion
".inc". There might be a potential security hole for using this.
At least for the PHP Version 4.0.3pl1 (which was installed & configured by my ISP) that I am
using, a hyperlink to a ".inc" file will always show all the contents of the file in the
browser. Unlike the ".php" files, any ".inc" files are treated by this server as
plain text files.
My suggestion is to use ".php" as the extendtion for the file to be included. If someone
really wants to use ".inc", he must make sure his server is configured correctly to
protect it.
Martin Lam