disable access to included files

Question

i have a litte question..

i want to disable the direct access to my included files. (example header.tpl.php, footer.tpl.php, confic.inc.php, db-connect.inc.php ect.)

Answer 1

do you see any security or other problems with this code?

In case your server is re-configured so that the .php don't get executed any longer, their source-code will be viewable.

But next to that your approach is a quite common way to do that. However error/404.php could contain the header('HTTP/1.1 404 Not Found'); line so you don't need to repeat it for each file. Same for the die; statement.

In each library/template etc. file:

require('../error/include_file.php');

In include_file.php:

if(!defined('MY_APP'))
{
    header('HTTP/1.1 404 Not Found');
    include('404.php');  
    die; 
}

Is maybe better for your design. Don't repeat yourself that much.

Answer 2

Why not just tuck it above the public_html folder or whatever you use as the default html folder and include with ../../. Then it would be available to scripts but the public would get a default 404/ file not found. I do this with config files that hold passwords and such so no one public can access them.

Answer 3

if (basename($_SERVER['SCRIPT_FILENAME']) == basename(__FILE__))
{
    //header("Location: index.php");
    exit("NOT ALLOWED");
}