note 31838 deleted from function.include by sniper

Note Submitter: neyr@attbi.com ---- I figured out another pretty simple way to ensure that include files are not executed OR displayed to the user when called directly (from a browser.) Say that I have an include file called "my_include.php." At the top of the file, place the following code: if(substr_count($PHP_SELF,"my_include.php")) exit; or instead of "exit" use: {echo "nice try!!!";exit;} NOTE: you'll have to change "my_include.php" to the name of any include file you place this code in. This way, if my_include.php is included by another file, EG "MAIN_FILE.php", then $PHP_SELF would be "/document_root/MAIN_FILE.php" and "my_include.php" would NOT be found within $PHP_SELF.. therefore nothing would happen. On the other hand, if my_include.php is called directly, then $PHP_SELF would be "/document_root/my_include.php" and "my_include.php" would obviously be found within $PHP_SELF, causing the script to exit. There may be an easier way of doing this than using substr_count, but I'm just converting to PHP from PERL, and don't know all of its quirks yet. Also, I may be wrong, but I don't think there is any major security hazard using this method. I tested out trying to do something like "my_include.php?PHP_SELF=blahblahblah" and it still functioned. $PHP_SELF must be assigned by php AFTER form variables are assigned.