Secure Include Files In PHP

8th July 2008 - 3 minutes read time

Including files in any PHP program is a very common practice and is nothing out of the ordinary. However, problems can occur when a user navigates to a script file that has a function, but is meant to be included as part of the larger program. For example, if your system includes a file to delete something then if that file is run by itself then there is a chance that it will delete everything.

Of course there are other factors like database access, global variables and sessions that would cause any script to simply error and not cause a problem. However, it is good practice to make sure that any include file is only run when it is included, and not when it is run on it's own.

The following little snipped of code can be placed at the top of any include files to make sure that it can't be run outside of an include. The file in this example would be called "test.php".

if ( preg_match("/test\.php/", $_SERVER['PHP_SELF']) ) {
  exit;
}

If the current filename (found with $_SERVER["PHP_SELF"]) is not test.php then the script simply exits. If the file is included then this $_SERVER will be the name of the file that includes this file.

Another step can be added to make sure that a file is only included by the correct file. The following snipped of code will cause a script to exit if the $_SERVER["PHP_SELF"] variable is not search.php.

if ( !preg_match("/search\.php/", $_SERVER['PHP_SELF']) ) {
  exit;
}
PHP

Comments

Another way would be to assign a constant in the main index file, and check whether the constant is available in any sub scripts using: Index.php
define("INDEX",true);
subindex.php
if(!defined("INDEX")) {
	die("You cannot view this file directly!");
}

Submitted by Jamie on Tue, 07/08/2008 - 09:35

Permalink

Add new comment

The content of this field is kept private and will not be shown publicly.
CAPTCHA
6 + 1 =
Solve this simple math problem and enter the result. E.g. for 1+3, enter 4.
This question is for testing whether or not you are a human visitor and to prevent automated spam submissions.

Related Content

Generating Colour Palettes From Images In PHP

4th August 2024

A common web design pattern is to incorporate an image into the design of the page. This creates a tighter integration with the image and the rest of the page.

The main issue in designing a page around the image is that the colours of the page must match the image. Otherwise this creates a dissonance between the image and the styles of the site.

Read more

Validating XML Files With XML Schema Definitions In PHP

21st July 2024

XML is a useful format for configuration, data storage, and transmitting data from one system to another. As a human readable format that can be easily read by machines it quickly gained favor in lots of different systems as a mechanism for data storage.

Read more

Approximating Pi Using A Circle And A Square

26th May 2024

Pi day was a few weeks ago, but I came across this simple approximation of pi recently and decided to put together an example in PHP since it seemed pretty simple.

This approximation of pi centers around a real world example, but we can simulate this using some code.

Read more

Drawing A Parabolic Curve With Straight Lines In PHP

12th May 2024

A parabolic curve is a type of curve where every point is an equal distance from a focal point. There a number of different way to generate this sort of curve using math, but one of the simplest is to use straight lines to create the illusion of the curve.

Read more

Recreating Spotify Wrapped In PHP

17th March 2024

I quite like the end of the year report from Spotify that they call "Wrapped". This is a little application in which they tell you what your favorite artist was and what sort of genres you listened to the most during the year.

Read more