Web студия "GrandView"

add a note User Contributed Notes
Безопасность

moehbass at gmail dot com
11-Jul-2007 10:34


First, q much simpler solution to preventing people from viewing code inside of an includable file would be to give include file an extension that ends with php (e.g. myFile.inc.php).



Secondly, and more importantly, why on earth would you want to put program-level code in an include file? By that I mean something life this:



myFile.inc.php

--------------------------------

...

if ($var = 'whatever')

    // connect to the database

else

    // do something else.

--------------------------------



An include file should not contain logic! Rather, it is an encapsulated unit of code that should not do anything on its own unless asked to. To implement this ideology, consider including function definitions only in your include files, then once you include them in the script, call such functions from within your program (i.e. the script that included the inc file). If you don't know the names of the functions ab initio, use call_user_func() or call_user_func_array() and pass it the name of the function that's dependent on context.



If you MUST put program-level logic in your include files, consider simply putting it in the program!



Why should you consider this? How about variable name clashes for a starter! You can think of more, I am shure!



Hope that helped

dangan at blackjaguargaming dot net
01-Feb-2007 06:41


I'd recommend a 404 over a 403 considering a 403 proves there is something worth hacking into.



index.php:

<?php

define('isdoc',1);

include('includes/include.sqlfunctions.php');

// Rest of code for index.php

?>



include.sqlfunctions.php (or other include file):

<?php

if(isdoc !== 1) // Not identical to 1

{

    header('HTTP/1.1 404 Not Found');

    echo "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>404 Not Found</title>\n</head>";

    echo "<body>\n<h1>Not Found</h1>\n<p>The requested URL ".$_SERVER['REQUEST_URI']." was not found on this server.</p>\n";

    echo "<hr>\n".$_SERVER['SERVER_SIGNATURE']."\n</body></html>\n";

    // Echo output similar to Apache's default 404 (if thats what you're using)

    exit;

}

// Rest of code for this include

?>

k
25-Oct-2006 04:06


How about not putting the php code in the web-root at all...?



You can create a public directory with the css, html, etc and index.php there. Then use the include_path setting to point to the actual php code, eg...



webstuff

  phpcode

  public

    images

    css

    index.php



then set the include path to "../phpcode" and, as php is executed from the directory of the script, all should be well.



I'd also call the main index "main.page", or something else, instead of "index.php" and change the web server default index page. That way you cant get hit by things trawlling the web for index pages.

steffen at morkland dot com
20-Sep-2006 06:38


In Reply to djjokla and others



Consider placing all incude files as mentioned before in a seperate folder containing a .htaccess containing a Order Deny,Allow



the create a index file, which is intended to handle ALL request made to you php application, then call it with index.php?view=index



the index file could look a bit like this:



<?php

switch($_GET['view']){

    case 'index':

        include('libs/index.php');

        break;

    default:

        include('libs/404.php');

        break;

}

?>



this could be an array or something even more creative. it actually does'nt matter how you do it... running all pages through one central script has one big advantage.... CONTROL.

at any givin time, you can easily implement access control to functions without forgetting crucial files.

djjokla AT gmail dot com
21-Apr-2006 08:22


If a single file has to be included than I use the following



index.php ( where the file is gonna be included )

___________

<?php

    define('thefooter', TRUE);

    include('folder/footer.inc.php');

?>



and the footer file (for example) looks this way then



footer.inc.php ( the file to be inluded )

___________

<?php

    defined('thefooter') or die('Not with me my friend');

    echo('Copyright to me in the year 2000');

?>



So when someone tries to access the footer.php file directly he/she/it will get the "Not with me my friend" messages written on the screen. An alternative option is to redirect the person who wants to access the file directly to a different location, so instead of the above code you would have to write the following in the footer.inc.php file.



<?php

    defined('thefooter') or header('Location: http://www.location.com');

    echo('Copyright to me in the year 2000');

?>



In normal case a redirection to an external site would be annoying to the visitor, but since this visitor is more interested in hacking the site than in reading the content, I think it's only fair to create such an redirection. We dont' realy want someome like this on our sites.



For the file protection I use .htaccess in which I say to protect the file itself and every .inc file



<Files ~ "^.*\.([Hh][Tt]|[Ii][Nn][Cc])">

Order allow,deny

Deny from all

Satisfy All

</Files>



The .htaccess file should result an Error 403 if someone tries to access the files directly. If for some reason this shouldn't work, then the "Not with me my friend" text apears or a redirection (depending what is used)



In my eyes this looks o.k. and safe.

webmaster

IV. Безопасность