Prevent direct access to a php include file

Question

I have a php file which I will be using as exclusively as an include. Therefore I would like to throw an error instead of executing it when it's accessed directly by typing in the URL instead of being included.

Basically I need to do a check as follows in the php file:

if ( $REQUEST_URL == $URL_OF_CURRENT_PAGE ) die ("Direct access not premitted");

Is there an easy way to do this?

instead of the die() you should test 'header("HTTP/1.1 404 File Not Found", 404); exit;'. This will (at least on apache) make the server return the normal 404 page. — gnud
– gnud, Commented Jan 4, 2009 at 17:08
Here are two easy methods I have explain to disable direct access in PHP included files - codespeedy.com/disable-direct-access-to-the-php-include-file — Faruque Ahamed Mollick
– Faruque Ahamed Mollick, Commented Jul 18, 2017 at 21:06

Varshaan · Accepted Answer · 2015-10-16 12:38:13Z

-1

if ( ! defined('BASEPATH')) exit('No direct script access allowed');

will do the job smooth

answered Oct 16, 2015 at 12:38

Varshaan

61312 silver badges24 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

jimasun Over a year ago

Copy paste from CodeIgnitor. That's cool but it actually doesn't do anything on it's own. The BASEPATH const is set in a index.php file that lays at the bottom of the tree structure. CI rewrites the URLs so there is no need for accessing the scripts directly anyways.

Varshaan Over a year ago

i know there is no need but if any one tries to do so

Benur21 · Accepted Answer · 2018-03-29 19:16:38Z

Redirect from that file to some other page. (like index.html)

.htaccess:

Redirect 301 LINK_TO_YOUR_PHP LINK_TO_INDEX.HTML

Andreas Carmblad · Accepted Answer · 2011-10-02 15:50:32Z

You can also try renaming the document you don't want people to be able to access. You could rename it to 47d8498d3w.php for instance. Just make something up that people most likely won't type as a http-request. If you include the file with SSI or PHP, the user won't be able to see the name of the document anyway.

You should never use that method to secure your files from unwanted executions.
Security by obscurity is not the best answer in this case :)

Collectives™ on Stack Overflow

Prevent direct access to a php include file

33 Answers 33

2 Comments

Comments

2 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

33 Answers 33

2 Comments

Comments

2 Comments

Linked

Related