Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

in my website there are PHP files that i include in other php files... they perform different tasks like connecting to my DB and various other functions... now i know the given path of my files.. so i can give the path like

http://www.mysite.com/myfiles/

this will give the directory listing of files in that directory..

i know to avoid the directory listing i will have put in a file name index.html OR index.php by doing so instead of directory listing

but still i know the path of file.. http://www.mysite.com/myfiles/con.php by doing this the code is executed but you can see the source OFFCourse because it is client side..

BUT is there a way to get that PHP file with its source code when somebody knows the path... ot will be security risk wouldn't it

share|improve this question
add comment

3 Answers

Well, first of all, you should be able to disable the directory listing (thereby making it not necessary to pollute your directory tree with useless index.php files) by just adding the following line into a .htaccess file in your includes directory:

Options -Indexes

Now, with regards to users being able to get the php source code, as long as your webserver is set up correctly to interpret php files and not just serve them directly, you should be fine (assuming that your include files don't echo() any variables or something silly like that).

share|improve this answer
add comment

If you have AddType or SetHandler defined for PHP files, then it'll be interpreted by apache/webserver before serving to clients. So client won't see the php source, but only the html generated.

share|improve this answer
add comment

If I understand you correctly, you'd like to get the PHP source for people knowing the actual URL of the PHP file. You might use something like that, but remeber: it's no real security, so better don't include this in PHP files containing private stuff like DB user/password etc.

<?php
 if($_GET['hash'] === "jV1V-7-VhS09K-_77GtEoOd86K2-ba-W") {
   show_source(__FILE__);
 }
?>

This way only people knowing that "hash" (and evil people brute-forcing you) can get that source code by going to http://example.org/myfiles/con.php?hash=jV1V-7-VhS09K-_77GtEoOd86K2-ba-W.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.