Secure Inclusion Of Code within php

what extension to use?

[kkonline]

Hi there,
I am currently working with a php file. The php tags <? are open

and in between there is a piece of php which i want to include in the main file. suppose

$query = "INSERT INTO upload (name, size, type, content ) ".
 "VALUES ('$fileName', '$fileSize', '$fileType', '$content')";

is the code which is to be included. As I would need to change that query again so that's why i want to include it separate.

Now my question is with what extension should I save the file having $query = "INSERT INTO upload (name, size, type, content ) ".
"VALUES ('$fileName', '$fileSize', '$fileType', '$content')"; so that i can include it in the main file.

Is it ok to include file with <?php some data?> into another file where the php tags are open?
If not then with what extension should i store the data mentioned above so user cannot see it. wen he types into the browser.?

The main concern is that if the user writes the name of the file which has data to be included then it should not be able to read it.

[Little_G]

Hi,

Just put the variable declaration in a php file (I tend to use .inc.php to make it clear what the file is for) eg:

query.inc.php:
<?php
$query = "INSERT INTO upload (name, size, type, content ) ".
"VALUES ('$fileName', '$fileSize', '$fileType', '$content')";
?>

You can block remote access to the file via apache config or .htaccess. It makes it easier if you put all your include files into one folder.

Andrew

[justgowithit]

PHP Includes [us2.php.net] should carry the extension that the file dictates.

For example:
include 'this_file.js';
include 'this_file.php';

When including a PHP file use the .php file extension. So long as the file is not outputting data to the browser (print/echo) nothing should be seen.

It is always a good idea to put your include directory outside of your ROOT for added security.

[edited by: justgowithit at 3:49 pm (utc) on Aug. 20, 2007]

[vincevincevince]

So long as the content of that external file is not being written based on general user input, then I think it's fine. i.e. if your user is asked to supply a filename, which then gets put into that query, then it's a big risk.