PHP security-source code exposed

Source code exposure

An important issue regarding inclusion is the exposure of source code. The main reason for this problem is the following common situation:

l Use the .inc extension for included files

l The included file is saved in the main directory of the website

##l Apache has not set the type of .inc file

l Apache’s default file type is text/plain

The above situation results in the included file being directly accessible through the URL. Even worse, they will be treated as normal text and not parsed by PHP, so your source code will be displayed in the user's browser (see Figure 5-1).

Figure 5-1. Exposure of source code in the server

It's easy to avoid this situation. You can only reorganize your application and put all the included files outside the main directory of the website. The best way is to only place the files that need to be published publicly in the main directory of the website.

While this may sound crazy, there are many situations where source code can be exposed. I've seen Apache configuration files written by mistake (and not discovered until the next startup), inexperienced sysadmins upgrading Apache but forgetting to add PHP support, and a host of other situations that lead to source code being exposed.

By keeping as much PHP code as possible outside of your website's main directory, you prevent source code exposure. At the very least, it's best to keep all include files outside of the site's main directory.

Some methods can limit the possibility of source code exposure but cannot fundamentally solve the problem. These methods include configuring Apache to handle .inc files the same as PHP files, using the .php suffix for include files, and configuring Apache not to accept direct requests for .inc files:

 <Files ~ "\.inc$">
      Order allow,deny
      Deny from all
  </Files>

While these methods have their advantages, none are as secure as placing the include files outside of the site's home directory. Don't rely on the above methods to protect your application, at most treat them as defense in depth.