Question

I have a php include with one function in it, I need to ensure that it can only be executed by inclusion within a local file and not from any external source.

What is the best method of testing for this?

-thanks
-sean

UPDATE:

thanks, here is some more info,
– I can’t move it outside the webroot, I’m updating an existing site
– testing for REMOTE_ADDR will always return the clients ip
– the only way I want this file called is by: include_once “sendmail.php”;

Answer 1

I see two cases of your problem:

1. File can be accessed over http with any browser. In that case you can define a CONST in your main application and then chek it in includes:

   main file:

   define('MY_APP', true);
   

   included file:

   if (!defined('MY_APP') || MY_APP !== true) {
     die('Access denied');
   }
   

2. File can be accessed via file system (from nearby virtual host for example). Than you can use SERVER_NAME and REQUEST_URI checks.