Question

I have been inspecting some PHP source codes and I more often than not find files starting with

defined('__someconstant__') or exit();

I know that this prevents the file to be accessed directly if a previous file defining __someconstant__, but then I wonder if this is really necessary… Isn’t there (even non-PHP based) a cleaner way of doing it without introducing this extra code in every file?

Answer 1

Isn’t there (even non-PHP based) a cleaner way of doing it without introducing this extra code in every file?

Presence of such snippets indicate bad code structuring, namely code automatically executing in global scope. You shouldn’t have this or exit(); code in pure function/class includes. It would be redundant there.

Code that does perform potentially dangerous actions shoult not be web-accessible in the first place. The or exit; approach is a workaround. It should always be accompanied by a FilesMatch and Deny from All in a .htaccess file however. Best set the whole include directory inaccessible.