Restrict direct access to .php files through browser and allow only index.php to access them

Question

I have a script on my website allowing users to edit/create their account. I want to restrict direct access to the files through browser (ex.www.mydomain.com/cp/page/login.php or www.mydomain.com/cp/home.php) and allow only index.php to access these files. I tried with .htaccess but index.php cant access them. Also i can't move them out of public_html folder. Its not include folder. How i can achive that? Please let me now if you need something else.

can you post your existing .htaccess code? using it is the correct way — ManZzup
– ManZzup, Commented Nov 8, 2013 at 17:08
So what URL would a user navigate to in order to do actions such as login? Can you show your htaccess? — Mike Brant
– Mike Brant, Commented Nov 8, 2013 at 17:10
the url is www.mydomain.com/CP/index.php <Files *.php> Order Deny,Allow Deny from all Allow from 127.0.0.1 </Files> <Files index.php> Order Allow,Deny Allow from all </Files> — Kosmas Papilis
– Kosmas Papilis, Commented Nov 8, 2013 at 17:11
By "allow only index.php to access them" do you mean allow the actual script to read them from the file system? Or do you mean the page that's loaded on the browser's end which links to other php URLs and is thus referred to by the index.php file? — Jon Lin
– Jon Lin, Commented Nov 8, 2013 at 17:29

anubhava · Accepted Answer · 2013-11-08 19:27:30Z

5

One way of doing that is by using include or require calls from PHP:

include '/path/to/script.php';

include is handled by PHP on server side hence Apache blocks will not impact this.

Then you can keep your existing <Files> directives to block access to .php file:

<Files *.php>
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
</Files>

<Files index.php>
Order Allow,Deny
Allow from all
</Files>

answered Nov 8, 2013 at 19:27

anubhava

790k67 gold badges603 silver badges671 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

James Over a year ago

Last seen 5 months ago. Doubt you're getting a green tick :(

AbraCadaver · Accepted Answer · 2020-01-17 12:57:36Z

2

One common way in PHP is to define something in index.php and check for it in the others:

//index.php
define('INDEX', true);

if(isset($_GET['page'])) {
    if($_GET['page'] == 'home') {
        include('cp/home.php');
    }
}


//home.php
if(!defined('INDEX') { die(); }
//more code

edited Jan 17, 2020 at 12:57

answered Nov 8, 2013 at 17:21

AbraCadaver

79.2k7 gold badges75 silver badges91 bronze badges

Collectives™ on Stack Overflow

Restrict direct access to .php files through browser and allow only index.php to access them

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related