直接脚本访问终止

Question

I got over this kind of security measure in a bunch of php projects. On top of every php file, there is a check if the script is invoked through direct access (eg via browser) or if it was properly included/required by the sites entry point:

if(!defined('SYSTEM_ENTRYPOINT'))
    die();

Is this a good practice to use in php projects? What should I consider when doing so? Are there edge cases? What data could possibly be exposed when not checking this?

Answer 1

You should handle that with URL rewrites. Organize your php files in a way so the visitor cannot touch your program logic.

For example, separate your code into two dirs: web and src. Web ahould contian only index.php ant htaccess file to route all requests to it. Src should all the program logic (controllers, db access abd so on). Inside src/index.php, code some logic that will decide which controller from src folder to include.

Make "web" directory your site's web root, and visitors won't be able to access any other php file.