note 17146 added to function.include

From: Date: Tue, 27 Nov 2001 20:25:53 +0000
Subject: note 17146 added to function.include
Groups: php.notes 
Request: Send a blank email to php-notes+get-21348@lists.php.net to get a copy of this message
Having .inc filenames in the examples is in my opinion very dangerous. A default webserver isnt configured to parse .inc files and common include names such as config.inc where database passwords etc may be stored should by no means by accident become visible to other users. The php newbie may not be aware of the fact that his includefiles is readable by pretty much anyone and this is a dangerous security risc. I think the examples should be modified to use .php extension since thats what the users have configured apache or whatever webserver to handle if they follow this manuals installation instructions, aswell as maybe adding a note about this issue in the manual entry to prevent future mistakes. -- http://www.php.net/manual/en/function.include.php http://master.php.net/manage/user-notes.php?action=edit+17146 http://master.php.net/manage/user-notes.php?action=delete+17146 http://master.php.net/manage/user-notes.php?action=reject+17146

« previous php.notes (#21348) next »