tags:

views:

76

answers:

5

What is the best way to "NOT" display a page directly in php?

Edit

There is a page = register.php a user cant open register.php directly. Only can access from index.php > Register.php Thanks

+1  A: 

You can put

die();

or

exit();

At the top of your PHP document. However, your question is unclear as to what you wish to accomplish.

JonnyLitt
+2  A: 

Any PHP files containing sensitive data, such as database password, should be stored outside of the document root and included where needed. That way, if an admin makes a serious mistake and the web server starts sending PHP unparsed, that data will be inaccessible.

Edit

You edited your question and it now seems you wish to prevent access to page without them coming from a particular page. You should be able to get some ideas from these questions:

http://stackoverflow.com/questions/2769481/deny-direct-access-to-a-php-file-by-typing-the-link-in-the-url

http://stackoverflow.com/questions/2587903/preventing-direct-access-to-a-php-page-only-access-if-redirected

webbiedave
@webbiedave; Document root : /UniServer/wwwDo you mean that we may insert config file outside of WWW?Thanks for help
Felicita
@Felicita: Certainly. Then just use `require` to insert them when needed. http://us.php.net/manual/en/function.require.php http://us.php.net/manual/en/function.require-once.php
webbiedave
@webbiedave; I know the ruquire and include functions. But I want to know "should be stored outside of the document root"In the example.com is in www we may insert it outside the www. Im I write?I have included my constants from main.php that is in www (main root) . I will change this! Thanks
Felicita
Yes. So long as your webhost has not prohibited you by using things like safe_mode/open_basedir.
webbiedave
+2  A: 

I think you want something like this:

if ( $_SERVER['HTTP_REFERER'] != 'http://YOUR_SITE/index.php' ) {                                                              
   echo "Can't access this page from this referer";                                                                            
   die();                                                                                                                      
}                                                                                                                              

// go on with your register.php code 
Jack
Just to add, this is easily spoofable. However, it will stop most regular users (who don't have malicious motivations).
webbiedave
+1  A: 

You can start a session in index.php and check for a certain variable from that session in the other pages.

jeroen
+1  A: 

make a file index.php

in it put

<?php
include 'register235235235235.php';
?>

make a file register235235235235.php

put whatever you want in there

As far as securing php includes, I only secure my database.php files which contain usernames and passwords.

Derek
hmmm... I don't get the point of this. What's the point of obfuscating the name of the register.php file if the user can still access the index.php file?
nico
because register.php is pretty easy to guess, but the user can't see the php code hiding the register235235235235.php. For example, google.com could have a file google.com/thisisasupersecretfile2325a.html and nobody would ever know it existed.Users can't see whats inside <?php ?> EVER, unless I missed a very important php class and need to revisit all my code.I guess instead of blocking the file from being viewed, it just hides it really well. I may have missed the point of the question.
Derek
@Derek: yes, I see the point of obfuscating the name. But if you were to put the code of register.php in the php file containing the include the users could not see it anyways. If a user is able to see the contents of the file (e.g. by gaining access to the server) he will also know the name of the register3242342555.php file.
nico