Remember that most files are public - Practical PHP Programming

This is NOT the latest copy of this book; click here for the latest version.

When you have files in your public HTML directory, people can get at them - it is that simple. There was a silly craze a while ago to use the file extension ".inc" for include files - scripts that only served to be included into other scripts. While this might make sense, and allows you to see how a script works simply by looking at its name, it is actually a major security hole.

For example, if you save your database connection info in a file, then include() that file into every script you write, that file would probably be called something like dbconnect.inc. Now, what happens if someone were to type www.example.com/dbconnect.inc directly into his or her web browser? Your web server would load the ".inc" file, and send it as plain text because it does not end in a PHP-handled file extension, which means that someone accessing the .inc file directly would see your source code.

A much better solution, if you particularly want to mark your files as include files, is to use the extension .inc.php - this way, they will be parsed by PHP before being sent to people directly, and therefore will not reveal your source code.

A PHP User - 05 Dec 2008

Yes. you can do that with a .htaccess file. it is quite easy and lets you handle any file as php. Be careful with this though because there are some security problems relating to file uploads. I know that if you have a .jpg or .gif or whatever processed by php and you let the user upload it, if you aren't careful they can inject php code into the exif comments or if you process txt files they could just write php and save it as txt then upload it.

A small issue to keep in mind also when you do this is that if you use a php/html editor (like dreamweaver) it will most likely not color the code anymore because it interprets it as plain text. There are ways around that but its way too difficult to explain in here. The best thing to do in my opinion is to either a) have an includes directory specified with .htaccess or php.ini or apache config. b) have an include directory somewhere in your site directory structure and just reference it from your script. or c) add a prefix to the filename like: inc_myfile.php.
You can combine any of these methods if you'd like to keep your site tidy.

17.1.4 Remember that most files are public

This is NOT the latest copy of this book; click here for the latest version.