Disabling direct script access

[MattehCarter]

Hey guys, I'm currently working on a new system for my latest project. I was wondering, is it possible to stop people accessing my scripts directly?

For example,
if a use went to the following URL

http://project.com/system/engine.php

it would return the message

'You do not have the correct permissions to access this script'

thanks

 

[Caustik]

You could use a boolean to determine whether they have access.

$isAllowed = false;
if($isAllowed == false){
die("You cannot access this script");
}

That's just basic stuff, you'd need to improve and secure it

 

[MattehCarter]

Yes, but then if I access the script from another file

require('scriptname.php');

it will still return the message 'You cannot access this script'

I need the script to return that message when they are visiting the page directly, and it isn't called from another file.

 

[Ron]

Just code it so that nothing executes when you open the page; use functions and call the functions when you need them.

 

[Hexadecimal]

<?php 
if (strtolower(__FILE__) == strtolower($_SERVER['SCRIPT_FILENAME'])) 
{ 
    echo 'Do not call this file directly'; 
    exit(); 
} 
echo 'The rest of the script here'; 
?>

5char

 

[wolfulus]

or you can simple deny access setting .htaccess (apache) rules in a folder
obviously you can't put it on the root folder... you'll need a folder of includes/libs

 

[RastaLulz]

Is everything run through index.php?

If so, you could do add the following to the index.php page:

define('IN_SCRIPT', TRUE);

Then add the following to every other page:

if(!defined('IN_SCRIPT')) {

   die('Sorry, but you can not access this file directly. :(');

}

 

[das7002]

or you can simple deny access setting .htaccess (apache) rules in a folder
obviously you can't put it on the root folder... you'll need a folder of includes/libs

+1

Over complicating things... just use an .htaccess file with

DENY FROM ALL

being the only thing in it

 

[MattehCarter]

@rastalulz everything is running through engine.php
@wolfulus @das7002 that method seems the easiest, I think I'll follow this!