can't include .php3 files only .inc (I have php4) security issue

From: Date: Fri, 10 Mar 2000 10:01:43 +0000
Subject: can't include .php3 files only .inc (I have php4) security issue
References: 1  Groups: php.version4 
Request: Send a blank email to php-version4+get-11857@lists.php.net to get a copy of this message
If I have a include('config.php3') statement in a file such as index.php3 of which the config.php3 file has functions defined in it and in the index.php3 file (after the include statement - or require statement) it makes a call to that function I get an error saying that function has not been defined. Here's the confusing part. If I rename the config.php3 file that's being called on by the include statement to 'config.inc' (or any extension not recognized as a php file [or anything else for that matter]) it works perfectly. This suggests to me that my server runs the included config.php3 file as if it's a separate file all together from the one that's calling it thus why it doesn't see the function. But when it's renamed to the .inc extension the server doesn't run that file and just includes the text from it. This means I can get includes to work BUT my concern is that if my config.inc file was discovered (either from a searchbot that ignores the robot.txt instructions) or from a lucky guess of which the URL to that file is entered - the person's browser shows it as a text file thus seeing the source code and all the passwords and such that shouldn't be that public. Any suggestions. I'm sure it's a setup thing but my server provider does not support PHP and I do not have root access to play around with myself. But if one of you have a good suggestion of what needs changing, then maybe I can convince them to look into setting it up properly. Any help would be really helpful on this. Jason Carlson

« previous php.version4 (#11857) next »