8 replies to this topic

[Ace-SG1-]

 <?php
if ( $_SERVER [ 'PHP_SELF' ] != '/index.php' )
{
die ( "You can't access this file directly." );
}
?>

is there a way for that it can assess it but if u put in like
www.yoursite.com/thepage.php where it says "You can't access this file directly." but if the site asks for it in like a scriped and it lets it go...

[Demonslay]

What you have there can work.

I personally just use a constant or variable, like this.

define('ACCESS', 'TRUE');
include('file.php');

Then in the included script, you could do this.

if(!defined('ACCESS') || ACCESS != 'TRUE'){
die('You can't access this file directly.');
}

This way, you can easily access the file from any script on your server, knowing your constant and the value. Also, if I'm correct, using your method wouldn't work with .htaccess rewrite rules, not quite sure.

[coolaid]

if he wanted to use his with mod rewrite, he would use replace php_self with request_uri

[Demonslay]

Ya, you're right.
Still, mine's universal.

[rc69]

Of course, the EASIEST way to do this would be to simply put the files you want to include above the web root directory (i.e. www, or public_html), and then include the files from there.

Then nobody will be able to access the file, and you won't have to worry about a security check.

[Demonslay]

Oh that's right.
But how would they not be able to view it? Because of .htaccess rewrites?

[Matthew.]

Nope, if you stick something above the public_html directory, as rc69 said, it is not viewable.

Simply use ../ when including the file (assuming your are working from the root of public_html or equivelant)

[Demonslay]

OH.
Lol, I always thought the root directory was public_html.
Thanks for clearing that up, can't believe I've thought that for so long. :wacko:

[Ruben K]

In my free PHP Framework I have a specific class which is created in the index page.
In my specific modules I have the following code to prevent them from being ran without the class from the index page:

if( !class_exists( 'debug' ) )
{
	  $this->error( "Please do not try to access this file directly.." );
}

When the page is not accessed through index.php, the class 'debug' does not exist and it will give you an error message.