Member Avatar for AbhishekBiswal

But the problem is: There a File names "includes" which includes the php files which have been included in some of the php files outside of it. But I want to lock/ make it inaccessible for users. Is it possible that the users can't access the folder/directory but the php files can? Well, Now I am testing my website on XAMPP, but I have plans to shift it to a web server. So, please answer so that I can my website more secure.

Thanks in Advance! :)

  • 2 Contributors
  • 3 Replies
  • 3K Views
  • 11 Hours Discussion Span
  • Latest Post Latest Post by cereal

Dani AI

Generated

is right that the folder should not be web-readable, but two common gotchas explain why your includes and CSS stopped working: (1) you likely stored public assets (CSS) inside the blocked folder, so the browser cannot fetch them; and/or (2) your PHP includes point to URLs or fragile relative paths that break once the folder is blocked. Keep CSS/JS in a public folder, and include PHP via filesystem paths, not HTTP. On modern Apache 2.4+, protect the folder with the current directive rather than the older 2.2 syntax. (httpd.apache.org)

A simple, robust pattern is to compute absolute paths from the executing script. For example, if your app root contains /includes with header.php and footer.php:

// From a PHP file in your web root (or anywhere in the app)
require_once __DIR__ . '/includes/header.php';
require_once __DIR__ . '/includes/footer.php';

__DIR__ resolves to the directory of the current file, so these paths work regardless of the URL used to reach the page. Alternatively, set an include path once and then require by filename:

set_include_path(__DIR__ . '/includes' . PATH_SEPARATOR . get_include_path());
require_once 'header.php';

See the PHP docs for __DIR__ and set_include_path. (php.net)

To block direct web access but still allow PHP to read the files, either move /includes outside the web root (best), or keep it under the web root with an .htaccess like:

# /includes/.htaccess (Apache 2.4+)
Require all denied

This denies HTTP requests while local require/include continue to work. If you are on Apache 2.2, the rule posted is correct for that version. Also ensure you are not including over HTTP; keep allow_url_include off (it is deprecated) and include from disk. (httpd.apache.org, php.net)

Recommended Answers

All 3 Replies

Member Avatar for AbhishekBiswal

You can use .htaccess:

order deny,allow
deny from all

put this file inside the folder to protect and no one can access from the web. Source: http://httpd.apache.org/docs/2.2/howto/access.html

bye :)

Yeah It works, but the main page and other pages which include the files inside the blocked directory/folder are unable to access them. The Files can't Access CSS, PHP Files can't access the header.php and footer.php files ( they are inside the blocked directory ) Plz Help!

Member Avatar for cereal

Explain better which files you want to limit access. Because CSS files can't be stored on that kind of directory.

And post a portion of code where you include the header.php that doesn't now work. So we can see what is happening. To include a file from that directory you should write something like this:

include('/path/to/file/header.php');

where the path is the server root, not an url. Bye :)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.