Question

When coding a web application, should all files be linked through a single index.php file.
Would doing such a thing help security, or would it make more complications later on.

How would you guys achieve this? Most (if no all) the site I have seen use this approach. Is there a reason for this?

Any help is greatly appreciated.

Answer 1

Doing so doesn’t such much about security.

The main advantage is that having every request go through index.php makes sure that you have a single entry point into your applications’s PHP code — which means you can put your initialization / configuration code there (or call it from there) and it’ll always get executed.

On the how to achieve this, you’ll need :

• A RewriteRule so all requests to non-existant files are sent to index.php
• In your index.php script (or somewhere called by index.php, like a router), put some code to call the right controller/action.

For the RewriteRule, here’s for example what is often done with Zend Framework :

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} -s [OR]
RewriteCond %{REQUEST_FILENAME} -l [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^.*$ - [NC,L]
RewriteRule ^.*$ index.php [NC,L]