RE: .INC files

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Wed, June 1, 2005 1:29 am, Denis Gerasimov said:
> Second, which way are you differ PHP .inc files from HTML .inc files?

There is no such thing as an HTML .inc file. :-)

All your HTML .inc files, by definition, if they are being require'd or
include'd into PHP *are* PHP .inc files.

It is merely a coincidence of your design that they happen to have no
<?php ?> tags in them.

You *MAY* want to separate those into another other non-web tree directory.

> Third, I always write context-independent include files.

Example?...

Can you guarantee that ever .inc and .inc.php and .php file in every
third-party application is context-independent?

Suppose your client insists tomorrow that you install [insert least
favority forum software here]?

You *NEED* to have the policy/procedure in place to get those .inc and
.inc.php and non-entry .php files *OUT* of the web-tree, or you will get
bit, sooner or later.

It's simply too easy to transfer a site and lose the .htaccess files, or
for a new/changed httpd.conf to not have the .inc rules or mess up PHP
completely or...

Why risk the possibility of your code being exposed or executed out of
context when it's so *EASY* to move the include files and set
include_path?

I just don't understand the resistance to such a simple straight-forward
elegant security measure.

For 5 minutes of time, you can avoid dozens of potential pitfalls. [shrug]

-- 
Like Music?
http://l-i-e.com/artists.htm

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux