Application tips: Dynamic Web pages directly do not allow access to PHP program files

Because we need to use some PHP files, and do not want others to directly access the file, we can in other include files such as global.php to define a parameter, in the page data.php before the visit to determine whether the parameter is defined, no definition is prohibited access

Define in global.php

<?php
Define (' ROOT ', './');
?>

In the data.php file, judge:

?
data.php
if (!defined ("ROOT")) {
echo "You cannot Access this Script directly, Have a nice day."
Exit ();
}
?>

Such code can solve many security problems, such as undefined variables [should be said to be undefined in this document].

But there is no point in having a local vulnerability before it is included. Like come in and read a code.

common.php file:

<?php
if (!defined (' ROOT '))
{
Die (' Do not access this file directly. ');
}
if (!isset ($root _path))
{
$root _path = './';
}
Require_once ($root _path. ' config.php ');
?>

If there is no restriction on!defined (' X '), then $root_path is not defined here to cause a remote inclusion.

And in the modified script there is a Update-->include 2 attacks caused by the local inclusion, then we can through this local inclusion vulnerability contains common.php lead to break!defined (' X '), into remote inclusion.