View Single Post
05-17-2006, 09:00 PM
#9
jjmac is offline jjmac
jjmac's Avatar
Status: Member
Join date: May 2006
Location:
Expertise:
Software:
 
Posts: 197
iTrader: 0 / 0%
 

jjmac is on a distinguished road

  Old

Someone already mentioned SSI and I too believe that is the best solution for the situation you've described. However I want to point out something for the benefit of anyone who may be using includes for something a little more complex.

The PHP include function will include any type of file also, no matter what extension, read it as text, then process any php that may be present.

There is a big however. If you include a PHP file that has any php code in it but is not named with an extension that is PHP processed by Apache, that information will be available as clear text if directly accessed. Let me explain by example.

This is how I learned the hard way years ago! The situation: I had an index.php that included header.inc. I thought it would be a good idea to name all of my include files .inc to be consistant and help organize the files.

Inside header.inc, I connected to a database which requires username and password to be inside a function to connect to a database.

I found out that if anyone typed in header.inc directly into the browser instead of going to index.php, the entire contents of the code showed up as the default plain text. In other words, my username and password for the database were clearly visible.

Just something to keep in mind, it doesn't sound like you're using this to include any type of processed information, but if in the future you do you'll want to make sure that whatever file type you use as an include is processed for php via apache to keep it from displaying as clear text.

Using .inc as an include extension is farily common, you just have to know what you're doing. For instance one workaround is to add the extension .inc to the list of PHP files that apache processes.