Programming PHP

code, configuration files, log files, and other data outside that directory (e.g., in /usr/
local/lib/myapp).This doesn’t prevent other users on the web server from accessing
those files (see the section on “File Permissions” earlier in this chapter), but it does
prevent the files from being downloaded by remote users.
If you must store these auxiliary files in your document root, you can configure the
web server to deny requests for those files.For example, this tells Apache to deny
requests for any file with a .inc extension, a common extension for PHP include files:
Order allow,deny
Deny from all
If you store code libraries in a different directory from the PHP pages that use them,
you’ll need to tell PHP where the libraries are.Either give a path to the code in each
include( ) or require( ), or change include_path in php.ini:
include_path = ".:/usr/local/php:/usr/local/lib/myapp";
PHP Code
With the eval( ) function, PHP allows a script to execute arbitrary PHP code.
Although it can be useful in a few limited cases, allowing any user-supplied data to
go into an eval( ) call is asking to be hacked.For instance, the following code is a
security nightmare:
Here are the keys...
This page takes some arbitrary PHP code from a form and runs it as part of the
script.The running code has access to all of the global variables for the script and
runs with the same privileges as the script running the code.It’s not hard to see why
this is a problem—type this into the form:
include('/etc/passwd');
Unfortunately, there’s no easy way to ensure that a script like this can ever be secure.
294 | Chapter 12: Security
This is the Title of the Book, eMatter Edition
Copyright © 2002 O’Reilly & Associates, Inc. All rights reserved.