PHP: Check if file is loaded directly instead of including?

Question

Hello

Is there a way to prevent user viewing an file but still use it as included to another file in php? Hope you understood!

Martti

Answer 1

If you use

define('APP_RAN'); 

in the file that includes it and then put

if(!defined('APP_RAN')){ die(); }

in included files it would die if you access them directly.

---

It would probably be better to put all of your included files above your DocumentRoot though.

For example, if your index page is at

/my/server/domain/public_html

You should put the included files in

/my/server/domain/

Answer 2

Just store the file outside your web root.

Answer 3

Under Apache, this is easy: add a <Files> directive in your .htaccess to prevent access to it from a web browser. This doesn't apply to PHP includes, and it is a good practice to hide several files from browser access (though usually you'll try to put all the non-accessible files together in a single directory).

<Files="myprivatefile.php">
    deny from all
</Files>

Under a different web server, you can hide the file out of your document root, but under some cases (like if your scripts are open_basedir'd in a strict way), it won't work.

Answer 4

You have to use an Encoder and Loader PHP extension:
Commercial:
http://www.ioncube.com/
http://www.zend.com/en/products/guard/
http://www.phpshield.com/ and http://www.sourceguardian.com

Free:
http://eaccelerator.net/
http://ombudi.com/

Pseudo (may be useful, not a true encoder):
http://www.raizlabs.com/software/phpobfuscator/

Answer 5

do not use any global code in your files, only functions and methods - and there will be no need to care about include vs. direct use.

Answer 6

if (__FILE__ == $_SERVER['PHP_SELF']) die("Direct access forbidden");

Answer 7

If you want to stop it from ever being displayed when not included here's a more automated way.

if (basename(__FILE__) == basename($_SERVER['PHP_SELF'])) header("HTTP/1.0 404 Not Found");

This way it'll still work if you end up changing the file name or something.