note 8227 modified in include by ronabop

One way to secure your included files that hasn't been mentioned, is to get them out of your web document path completely. Using unix/apache, edit the php.ini file to include something like this: include_path=/usr/local/apache/phpinclude Put all your files that you want to include in the directory above (or whatever one you chose). That way you never have to put sensitive documents in an area where users might be able to access them. http://www.php.net/manual/function.include.php