如何保护PHP文件？

Question

I have made a PHP code. (myphp.php)

if(count($_GET) === 1 && isset($_GET['secretcode'])) {
  echo "my personal data";
}
else{
echo "Not Found"
}

So ,user need to browse something like " http://server.com/myphp.php?secretcode " in order to view the PHP.

The question is, does it safe to do this? Can someone bypass the PHP? If so,how to make it more secure?

Something like this might work

//.htaccess
<Files *.php>
Deny from All
</Files>

But I want everyone can access it only if they entered the correct parameter.

Thanks.

Answer 1

Depending on how sensitive your information is, no, this is not secure .

If it is only a sonnet that you wrote which you do not want other people to read, it may be good enough. If it is your personal bank account information then this is terrible security.

GET parameters are apart of the URL, and URLs that you access are logged and stored on third party servers such as your ISP's, as well as their upstream providers. If you happen to access this URL on an open WiFi then anyone else on that network will be able to see what URLs you are visiting and will result in your "secret" URL leaking. If you try to funnel your access through a proxy you may protect the secret code from those people, but you just leaked that information to the proxy instead.

You may be able to mitigate this to some extent by only browsing to your secret URL over HTTPS, but even then you may accidentally visit it when on a network for which an administrator has a root certificate installed on your machine (such as an employer's laptop), in which case your secret is now out. You will also in general not be able to protect what domain you are visiting regardless of whether you are using SSL/TLS or not.

As @chris85 mentioned in his comment, you aren't really checking if the secret is correct. All I need to access your secret information is just the parameter name since you are not also checking that the value equals something.

You may run into usability issues in your own usage as well. Your protection will deny you access if you ever need to use more than 1 query parameter other than your "secret" code.