Preventing remote include

[tebrino]

I wrote several PHP scripts and made them public and since these scripts appear to be quite popular I am now worried about their security. All scripts have similar config file which stores db passwords and usernames. Ie:

$username = "mysqlusername";
$pass = "mysqlpass";
$db = "mysqldb;
...

Is there some good way to protect these files from being remotely included? Since this is public script anyone could do something like this:

<?php
include("http://www.example.com/config.php");

echo $username;
echo $pass;
?>

Thanks in advance.

[coopster]

I would keep them below the DocumentRoot for starters. Message #17 has a nice tip ;)

Good PHP solutions to small problems [webmasterworld.com]

[tebrino]

Thanks for the tip. Actually I am trying to prevent them from including my files and finding out sensitive information.

[coopster]

If you keep the documents with sensitive information below your DocumentRoot (or public area of your directory structure), they can't be remotely included.

[tebrino]

That means that if I store these files in, for example, http://www.example.com/includes/config.php they cannot be included remotely?

[MattAU]

Actually, what it means is that you store the files on your server in a directory not accessibly via the web, such as:

/home/privatefiles

and you keep your web pages in:

/home/www

and you include the files with:

include('/home/privatefiles/config.php');

This way your private files aren't accessible to anyone that isn't on the local machine. Hope this helps.

[coopster]

Similar discussions:

Performance and Multiple Include User Functions [webmasterworld.com]
Best practice in placing db connection file/folder [webmasterworld.com]
MySQL queries spanning multiple tables with different keys [webmasterworld.com] message #7 has some very good links

[tebrino]

Thank you all for these useful threads. Personally I keep all sensitive files above www root. What I'm trying to acomplish is to create simple installation script which will install MySQL tables and write data to config files. Problem is that many users don't have access to folders above their www root. I also noticed that many popular packages, like PHPNuke and PHPMyAdmin, keep thair config files in public folders.