note 36128 deleted from function.include by sniper

Note Submitter: mikkel at ellsons dot net ---- This is in reguard to the security method mentioned above : <?php include($DOCUMENT_ROOT . "_include/top.php"); ?> This is probably more trouble than it's worth. By simply naming any included files with a .inc extension and adding a few lines into you httpd.conf file you can stop someone from viewing your includes. The config directive would look like this: <Files ~ "\.inc"> Order allow,deny Deny from all </Files> Apache will then stop any page with a .inc extension from being displayed directly. Furthermore, it's been suggested that testing the existance of the file before including it would be a usefull technique (which it is), but I see a flaw in the implimentation listed in this forum. From above: <?php if ( file_exists($page) ) AND !preg_match("#^\.\./#",$page) ) include($page); ?> Should be: <?PHP if( !@include("filename.inc") ){ @include("./otherFile.inc"); } ?> The include path was designed to reduce the use of exact paths in include(), the file_exists() function will not search the include path, so your files won't be accessed. Now I should warn you, (include("file.inc") == true) evaluates to false even when the file is in the path. I couldn't find what type include() returns (please email me if you know) so this may be an undocumented feature. Another advantage of the include path is its location. You can keep your include directory outside of your web servers file path, so a user would never be able to browse to that directory. This adds another level of security above the .inc directive. If I've made a mistake, PLEASE let me know. Mikkel