Question

I want to prevent direct access my install.php file, unless the user has gone through the steps of filling information and submitting the form.

install/index.php:

define("ACCESS", true);

// HTML form to take to install.php

install/install.php:

if (!defined("ACCESS")) {
    echo "You cannot access this page directly.";
    exit();
} else {
    // Run SQL Queries
    echo "Database installation successful.";
}

Obviously this won’t work. How I can get this concept to work?

Additional questions:
What is the best practice for this?
Should I be using a constant or a function?

Answer 1

You can do this, but instead of having the user access install.php directly, you would include it from index.php which defines the constant.

This way, you control when they view that script by having index.php load it when appropriate, and they still cannot access it directly because of your check for the defined constant.