disable access to included files

Question

i have a litte question..

i want to disable the direct access to my included files. (example header.tpl.php, footer.tpl.php, confic.inc.php, db-connect.inc.php ect.)

Answer 1

do you see any security or other problems with this code?

In case your server is re-configured so that the .php don't get executed any longer, their source-code will be viewable.

But next to that your approach is a quite common way to do that. However error/404.php could contain the header('HTTP/1.1 404 Not Found'); line so you don't need to repeat it for each file. Same for the die; statement.

In each library/template etc. file:

require('../error/include_file.php');

In include_file.php:

if(!defined('MY_APP'))
{
    header('HTTP/1.1 404 Not Found');
    include('404.php');  
    die; 
}

Is maybe better for your design. Don't repeat yourself that much.