Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #5209

Re: Forum displays PHP code, not website

Followups directed to: comp.lang.php

Show all headers | View raw

P E Schoen wrote:

> "Jerry Stuckle"  wrote in message news:jkg6cn$mjd$1@dont-email.me...
>> On 3/22/2012 4:43 PM, M. Strobel wrote:
>>> Hmm - shure? He said "PHP application on the server was missing or
>>> defective?".
>>> Missing not, the code was displayed. Defective? Only when the
>>> application printed out PHP code - well, unlikely, but not impossible.
>> Yes, it could be an application problem.  For instance, using
>> short_open_tags in the code and an update to the server disabled them.
> 
> Well, it seems fine now, and it's not my server. Thanks for the variety of
> comments. I do have a few PHP pages on my websites, and I think they are
> well protected enough that the server would never display the code - at
> least I hope so, because I have passwords hard coded in them.

Although it is often the initial/beginner's approach, it is a Really Bad 
Idea.  Security is one aspect; deployment and maintenance is another.  For 
example, you would certainly not use the same database passwords locally as 
you would on the server you deploy to, and you would certainly not want to 
modify the main code every time a new user account becomes necessary.

The least you should do is keep the main code and authorization information 
apart.  The most simple way is an include that only PHP can read.  The most 
secure and versatile way – PK applications aside – is to use an 
initialization file outside of the DOCUMENT_ROOT; for PDO there is a user-
provided example in the PHP Manual. 

In fact, the majority of the LOCs of a web application should be located 
outside of the DOCUMENT_ROOT (which is why ~/cgi-bin is deprecated), but 
that is not always possible.


PointedEars
-- 
Anyone who slaps a 'this page is best viewed with Browser X' label on
a Web page appears to be yearning for the bad old days, before the Web,
when you had very little chance of reading a document written on another
computer, another word processor, or another network. -- Tim Berners-Lee

Back to comp.lang.php | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Forum displays PHP code, not website "P E Schoen" <paul@peschoen.com> - 2012-03-21 20:57 -0400
  Re: Forum displays PHP code, not website Dave Pyles <dave@user.invalid> - 2012-03-21 21:26 -0400
    Re: Forum displays PHP code, not website "P E Schoen" <paul@peschoen.com> - 2012-03-21 23:20 -0400
      Re: Forum displays PHP code, not website "J.O. Aho" <user@example.net> - 2012-03-22 06:46 +0100
      Re: Forum displays PHP code, not website "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-03-22 10:29 +0100
      Re: Forum displays PHP code, not website Erwin Moller <erwinmollerusenet@xs4all.nl> - 2012-03-22 10:41 +0100
      Re: Forum displays PHP code, not website Tim Streater <timstreater@greenbee.net> - 2012-03-22 11:12 +0000
      Re: Forum displays PHP code, not website The Natural Philosopher <tnp@invalid.invalid> - 2012-03-22 11:30 +0000
      Re: Forum displays PHP code, not website Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-03-22 20:38 +0100
        Re: Forum displays PHP code, not website "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-03-22 21:43 +0100
          Re: Forum displays PHP code, not website The Natural Philosopher <tnp@invalid.invalid> - 2012-03-22 21:25 +0000
          Re: Forum displays PHP code, not website Jerry Stuckle <jstucklex@attglobal.net> - 2012-03-22 17:42 -0400
            Re: Forum displays PHP code, not website "P E Schoen" <paul@peschoen.com> - 2012-03-22 22:23 -0400
              Re: Forum displays PHP code, not website Jerry Stuckle <jstucklex@attglobal.net> - 2012-03-22 22:51 -0400
              Re: Forum displays PHP code, not website gordonb.vi9et@burditt.org (Gordon Burditt) - 2012-03-22 23:37 -0500
                Re: Forum displays PHP code, not website "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-03-23 18:13 +0100
                Re: Forum displays PHP code, not website "P E Schoen" <paul@peschoen.com> - 2012-03-23 21:07 -0400
                Re: Forum displays PHP code, not website Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-03-24 10:44 +0100
                Re: Forum displays PHP code, not website Jerry Stuckle <jstucklex@attglobal.net> - 2012-03-24 09:07 -0400
                Re: Forum displays PHP code, not website Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-03-24 10:35 +0100
              Re: Forum displays PHP code, not website Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-03-24 10:24 +0100

csiph-web