How can I prevent "include files" from being seen by users?

Question

My site's main file(index.php) code is here:

<?php include 'header.php'; include 'sidebar.php'; include 'content.php'; include 'footer.php'; ?>

But I don't want any user to see these include files by writing "www.domain.com/header.php". Should i insert a php code in these files or is that possible?

Quentin · Accepted Answer · 2012-05-14 08:53:48Z

You have several options.

Keep the files outside the webroot (so they don't automatically get URIs of their own)
Configure your webserver so it refuses to serve them
Test if a variable/constant is set, and then set it in every one of the files that is allowed to include them. exit if it is not set.

Andreas Eriksson · Accepted Answer · 2012-05-14 08:55:01Z

Here's a PHP for you.

if(basename(__FILE__) == basename($_SERVER['PHP_SELF'])){exit();}

In short, this quits execution if the calling file is itself.

Source: http://thephpcode.blogspot.se/2009/07/creating-include-only-php-files.html

Nice work, man. It is a perfect answer, in my opinion. Sometimes it is not possible(maybe difficult) to apply variables or constants to included files because they are called via AJAX

adrien · Accepted Answer · 2012-05-14 09:03:54Z

2

You can define a constant in your main file, and use it in your included files to detec wether they were really included or not:

index.php

<?php define('REALLY_INCLUDED', true); include'header.php';

header.php

<?php if(!defined('REALLY_INCLUDED') || !REALLY_INCLUDED) { exit(); } ...

edited May 14, 2012 at 9:03

answered May 14, 2012 at 8:53

adrien

4,44928 silver badges26 bronze badges

3 Comments

Marc B Over a year ago

... and then you forget the constant somewhere and expose the file. "oops". if you want something kept private, don't put it into the document root in the first place.

Bart S. Over a year ago

This will throw some unnecessary warnings. Add quotes during definition: define('REALLY_INCLUDED', true); and use the correct function to check if the constant is defined: if(!defined('REALLY_INCLUDED') || !REALLY_INCLUDED) { ...

WebDeg Brian Over a year ago

What if there is an included file that is called in another included file? And the first one is called by Javascript? The first one cannot define the constant and check if the constant has been set at the same time. It won’t work. I suggest @AndreasEriksson ‘s answer

Collectives™ on Stack Overflow

How can I prevent "include files" from being seen by users?

3 Answers 3

Comments

1 Comment

3 Comments

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

1 Comment

3 Comments

Related