Posted by Michael Fesser on 06/22/07 01:05

..oO(J.O. Aho)

>It's true, the file extension don't matter when you include files in a php
>file, but by default a *.inc file won't be parsed if it's directly accessed
>
>example: http://www.example.net/myincludefile.inc
>
>This can be a security issue if you store database login/passwords in a *.inc
>file, which you should avoid to use any other extention than *.php, which will
>be parsed on a php enabled server.

Of course these files should be stored outside the document root.

Even a .php extension is no guarantee that no visitors will ever be able
to view that file. A server update, a misconfiguration, whatever --
there are some situations where even a .php file could be delivered
unparsed.

Micha

• Next in forum: Why PHP instead of Perl?
• Prev in forum: Re: Emails aren't sending
• Thread view: Re: Parsing a php include (which also contains php code) - or "Reparsing" the php file

[Reply to this message]