[Wildo]

With this tutorial I'll show you people how you can easily protect your php files with just a couple lines of code! Here it goes:

for example: you do not want people to be able to go directly to your config.php file.

lets assume your config.php file looks like this:

<?PHP

$chost = "localhost";
$cusername = "YOURUSERNAME";
$cpassword = "YOURPASSWORD";
$cdb = "YOURDATABASE";

mysql_connect($chost, $cusername, $cpassword);
mysql_select_db($cdb);

?>

That is just a basic mysql connect script. now to protect it! We are adding 4 lines of code, take a look:

<?PHP
if(!defined("SESAMOPEN")){
	echo "What are you doing here? You're not allowed to be here, be gone you pest!";
	exit();
}

$chost = "localhost";
$cusername = "YOURUSERNAME";
$cpassword = "YOURPASSWORD";
$cdb = "YOURDATABASE";

mysql_connect($chost, $cusername, $cpassword);
mysql_select_db($cdb);

?>

Ok, you may think, what in gods name is he doing? Well, hmm ok I understand, let's explain what I just did.

<?PHP
if(!defined("SESAMOPEN")){
?>

We are using a if statement to check if 'SESAMOPEN' has been defined, if it is not (see, we are using a '!' in front of defined) tell the user that they are lost and should go back.

<?PHP
echo "What are you doing here? You're not allowed to be here, be gone you pest!";
?>

and last using exit(); to stop and closing the if statement with a }

<?PHP
	exit();
}
?>

Now you think you're ready, but your not! we are only 50% done! Because, with that code SESAMOPEN will never be defined and thus your own script wont even be able to get access to config.php!

So whenever you want to include config.php to your script to get mysql content you need to add this above the line where you include config.php:

<?PHP
define("SESAMOPEN", 1);
?>

That line gives SESAMOPEN a value, so it is ‘defined’ and it will pass the if statement in your config.php file!
And KABOOM, you're done, to test, go directly to your config.php and see if it works

if you need help with this tutorial feel free to comment!

Wildo

[Ben]

Very handy indeed!

Thanks for the tutorial Wildo!

[Wildo]

could be shorter, wrote it ages ago, litteraly I think

I used

echo "message":
exit ();

while I could have done

exit ("message");

little shorter

Wildo

[BenG]

Excellent.

You rock wildo

[Cats Corporation]

Pardon my ignorance, but is there really anyway anyone (aside from the webmaster) can access the php files of a website?

I tried typing something like www.mydomain.com/sidebar.php, and all I get is a blank page. I look at the code and it is also blank.

Sorry if this question sounds not-so-intelligent. I started learning php only last week.

[Tucker]

Can't see how anyone accessing one of my config files would be a problem. If you're not outputting anything then there's nothing to worry about!

[php_penguin]

this is to do with using the include() function across domains.

For example if your config file is at:
http://www.mysite.com/config.php

I could do:

<?php 
include( "http://www.mysite.com/config.php" );
print_r( get_defined_vars() ) );
?>

and print out your (probably define()'d) mysql passwords.

[Tucker]

Ahh yes of course! Feel a tad embarassed now, will investigate..

[Cats Corporation]

He he he! It seems I really need to study the deeper and more arcane concepts of php for this to make sense.

Bye! Gotta grab a book

[Tucker]

Hey Penguin, I tried hacking one of my own config files and whatever I did, i couldn't read the variable like $dbusername etc.

Presumably it's not possible as I have register globals off?

[mandy]

it seems very interesting ..
i will definitely try..
thanks for sharing the coding with us ..