PHP Backdoor URL to prevent _php tips

For example, the following Web application might display sensitive information to the login user:

Copy Code code as follows:

<?php
$authenticated = FALSE;
$authenticated = Check_auth ();
if ($authenticated)
{
Include './sensitive.php ';
}
?>

Because Sensitive.php is located in the site home directory, the browser can bypass the authentication mechanism to access the file directly. This is because all files in the site's home directory have a corresponding URL address. In some cases, these scripts may perform an important operation, which increases the risk.
To prevent backdoor URLs, you need to make sure that all of the included files are saved outside of the site's home directory. All files saved in the site's home directory must be accessed directly through the URL.