Preventing output of includes

[Adrian2k4]

i have one main script (index.php) that generates my page.
all other subscripts are included into index.php.
if a user requests a inculde directly he gets the output of the include. i dont want this to happen so i would like the include to check if it is being parsed as a "stand-alone" script or if it is being parsed as part of index.php.

does anybody know how to do this?

i was thinking of something like:

<?php
if (!($condition)) {
header("Location ../index.php"); // redirect to main page
} else {

// *snip*
// normal content of the include
// *snip*

}
?>

but what would $condition be?

thanks for your help & best regards
adrian

[Timotheos]

Wouldn't it work just to set $condition = TRUE in your index.php file and then for your include files...

<?php
if (!(isset($condition)) {
header("Location ../index.php"); // redirect to main page
} else {

// *snip*
// normal content of the include
// *snip*

}
?>

[mincklerstraat]

Timotheos's advice is good - what's normally been done for this kind of security check is defining a constant and checking that, since constants, are, well, constant, and they also can't be messed with in the case that registerglobals gets turned on.

I also usually don't make this redirect to the main page; I give a 404 header and emulate the apache 'file not found' page just so scriptkiddies don't know there's anything there in the first place. Put this all into one nice function so it's just one line of code per include file. Happy coding and sorry for being snotty with you on the 'search snippet' thread; I'd mistaken you there for some other guy who was always asking more or less, 'my code's broke, herez 250 lines of broken code, fix it and write some more for me.' You're not like that guy at all. Cheers.

[Adrian2k4]

in the meanwhile i came up with this code:

if (realpath(__FILE__) == realpath($_SERVER['SCRIPT_FILENAME'])) {
header("HTTP/1.0 404 Not Found");
}

but i guess checking if a constant is set would be faster.

@mincklerstraat
no problem about the snippet thread... your last post was helpful. i decided to to the snippet script at a later stage, since the whole CMS i'm doing is quite a large project, and the snippet's arn't crutial to page functionality. but when i find the time to do that script i'll post it ;-)

[mincklerstraat]

When you do, be sure to stickymail me! I'd definitely be interested in borrowing this code or at least getting some inspiration from it. I'm going to have to be doing my own search function soon enough and this feature would be great. Much success!

[Warboss Alex]

I always use constants for this, works a treat. I tend to halt script execution though, because if someone's trying to access individual include files then likely as not they're up to no good.

//in calling page
define('MAIN', 'main');

//in include files
if (!defined('MAIN')) die();

You can replace die() with a header redirect or whatever you want. It's more user-friendly I suppose, but since they shouldn't be knowing how to navigate to the include files anyway, I'm not inclined to be TOO friendly.

[mincklerstraat]

Quite right to do so! Adrian2k, missed this in the code you posted.

You *must* do both. If you output a 404 header, this doesn't stop further php execution, nor the browser from outputting the rest of the page. So be sure to put in the die() there too - this is the type of thing you're likely to forget since it's not going to come up in 'normal' code execution.

[merlinti]

I use this in the include file:
<?
if (!$main){
header ("Location: index.php?page=home");
}
?>

And this in my index.php file:
<?
$main = 1;
?>

Does anyone know if Google looks badly upon this?
I also use mod rewrite to make the url: nch-home.htm.

thanks