Protecting PHP Files from Download?

[karlectomy]

Howdy,

I was wondering if there was an way to protect PHP include Files from being downloaded from my host servers. Can this be done with permissions? or do I need access to serverside options to prevent access to these files?


Any help would be greatly appreciated.

[JeremyMiller]

Not sure what you're doing in the first place that allows them to be downloaded -- mine all just get executed.

That said, if you want to deny running the script directly, you can add in a flag that proper scripts set before including the file and which is subsequently checked.

For example, let's say that you have the following index.php file:

<?php
$page_body = '<H1>Today Rocks!</H1>';
 
$allow_file_includes = true;
require_once('template.php');
?>
 

it includes template.php which has a check at the beginning:

<?php
if ($allow_file_includes !== true) {
  header("Location: index.php");
  exit();
}
 
echo $page_body;
?>
 

If someone visits template.php directly, they'll be redirected to index.php

[Atli]

Hi.

If you are using Apache as a web server, it is likely that you can use htaccess files to specify what files your clients can and can not use. This will not affect PHP includes, as they are done server-side.

Try adding a file called '.htaccess' to the folder that contains your include files and add the following as it's contents. If htaccess is available any request for a .php file should be denied.

 <Files *.php>
   Order allow,deny
   Deny from all
 </Files>
 

[pbmods]

Heya, Karlectomy.

If your server allows, try storing your include files outside your website root.

[karlectomy]

Hey Thanks all for the suggestions,

I am using Godaddy on a (pretty sure) shared server so I don't believe I have access to server settings.

I think I have what I need. I was thinking if I opened a page and saved it to my machine I would be able to view the code.. well I was wrong. I *hope* my connection strings and such are reasonably secure from prying eyes.

That access variable is a great idea to prevent direct execution. Thanks a lot. Now I have to go back to all my functions and include the access token variable :O. oh well better safe than sorry!

Thanks again