映射只能访问Web服务器而不能访问其他用户

Question

On my site i use a lot of includes, the most of the includes should only be accessible for the webserver and not for the rest of the world. So if i include "../include_map/file.php" in a page on my site, it should not be possible to request with an URL by other users in the world ("website.com/include_map/file.php"). Is there a possibility to protect the map with the include files so that only the webserver can include the files?

Answer 1

PHP can include files from everywhere (also non public directories) on the servers harddrive.

for example, if your htdocs is located in /var/www/domain/htdocs/ you can also include files located in /var/www/domain/include_map while the webserver wont be allowed to read from there (if configured properly).

you can then test to access the file with www.yourdomain.com/../include_map/file.php. if you can still access it like this, your webservers configuration needs some attention to prevent others from reading your logs and other things.

another way is to deny access to the directory via .htaccess or apache config. php can still include the files, while users cant access them from the internet.

in the apache config you would do something like:

<Directory /inlcude_map>
   Order Deny,Allow
   Deny from all
</Directory>

in a .htaccess file you could write

Order Deny,Allow
Deny from all

the .htaccess file should be located in the directory you want to secure. Consult your server provider to find out which way is best for you. As stated in the comment you have to find out if .htaccess is an option for you first.