PHP Include <head> tag?

I know i just posted below, but i have another question.

Is it dangerous to have the tag be included using PHP include? Is it dangerous to have the tag or tag or doctype to be included using PHP?

jonow

Junior Poster

104 posts since Jan 2009

Reputation Points: 10

Solved Threads: 0

2 Years Ago

0

Actually it doesn't really matter wether you include HTML or you just write it manually in the script.

But be aware that when you either write or include things in the script such as databaseconfig or variableconfig. If due to a error, the server doesn't process the php scripts, they will be shown as regular html and then people will be able to read the php (including all the variables). They can then be able to use that to for example copy/adjust your database or get access to secure parts of the website.

To sum it up:

It doesn't matter if wether you include or write the , and tags in a php file. I recommend you always include configs that are either hidden from the user with .htacces or that are located above the webroot.

~G

Graphix

Posting Pro in Training

432 posts since Aug 2009

Reputation Points: 82

Solved Threads: 74

2 Years Ago

0

Hmm, PHP include() (and require()) are server side methods that include a file on the server to the current file. On the other hand, the and tags are client side HTML.

Not really connected at all, so to answer your question, no. It's not dangerous to have those tags.

jomanlk

Junior Poster

106 posts since Oct 2009

Reputation Points: 13

Solved Threads: 19

2 Years Ago

0

Wow! i speedy replies! Just what i needed.

So can you elaborate a little more on how to make the include funtion more secure through the htaccess file?

jonow

Junior Poster

104 posts since Jan 2009

Reputation Points: 10

Solved Threads: 0

2 Years Ago

0

If your server is the production/live server the most key things you have to do is disabling error reporting in PHP (display_errors in php.ini should be set to off) and disabling directory browsing in Apache described here and here

jomanlk

Junior Poster

106 posts since Oct 2009

Reputation Points: 13

Solved Threads: 19

2 Years Ago

0

I obviously have directory browsing disabled but i never thought of disabling the PHP errors. I will now do that after i am done testing my PHP

And other suggestion for secure PHP include?

jonow

Junior Poster

104 posts since Jan 2009

Reputation Points: 10

Solved Threads: 0

2 Years Ago

0

I don't know what else server side. Not my strong point. But if you're using a framework like Zend or CakePHP you can move your source files off the www-root so that they aren't accessible from the outside. Nothing else comes to mind.

jomanlk

Junior Poster

106 posts since Oct 2009

Reputation Points: 13

Solved Threads: 19

2 Years Ago

0

I am not using a framework

Than you for your help!

jonow

Junior Poster

104 posts since Jan 2009

Reputation Points: 10

Solved Threads: 0

PHP Include <head> tag?

This question has already been solved