Search This Blog

Monday, April 5, 2010

Things to be Careful About with Include and Require

Many Web servers are not set up to parse .inc files, so it's better to put includes in .php files. That way their (potentially sensitive) contents are never visible unintentionally to the everyone out there. For example, if someone knows (or just suspects) that you have .inc files on your site (perhaps containing sensitive information such as database passwords), they can simply enter the complete URL in their browser, and they can see the unevaluated source code. Always put a .php extension on your include files to make sure they get evaluated.


And if you want to include another include file via a common.inc.php file that goes at the top of every page (it's a common practice to do this) but worry that some function might accidentally be defined twice, use include_once or require_once. These work the same way as include and require, but will only include the same file once, no matter how many times they are actually included.