note 17146 added to function.include
| From: | martin at humany dot com | Date: | Tue, 27 Nov 2001 20:25:53 +0000 |
| Subject: | note 17146 added to function.include | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-21348@lists.php.net to get a copy of this message | ||
Having .inc filenames in the examples is in my opinion very dangerous. A default webserver isnt
configured to parse .inc files and common include names such as config.inc where database passwords
etc may be stored should by no means by accident become visible to other users. The php newbie may
not be aware of the fact that his includefiles is readable by pretty much anyone and this is a
dangerous security risc. I think the examples should be modified to use .php extension since thats
what the users have configured apache or whatever webserver to handle if they follow this manuals
installation instructions, aswell as maybe adding a note about this issue in the manual entry to
prevent future mistakes.
--
http://www.php.net/manual/en/function.include.php
http://master.php.net/manage/user-notes.php?action=edit+17146
http://master.php.net/manage/user-notes.php?action=delete+17146
http://master.php.net/manage/user-notes.php?action=reject+17146