Execute a script, but not let users access it [duplicate] - php

Question

This question already has answers here:
Closed 11 years ago.
Possible Duplicate:
How to hinder PHP files to Global Access
For a project I'm working on, I require("xxxx.php"); to include certain parts of my website into my site.
For example, I have header.php and my site just uses a simple require("header.php") to display to the world.
Now, how do I make it so the page include header.php's content, but make it so the user can't access it via
http://mywebsite.com/header.php

Answer 1

Put the file somewhere outside the DocumentRoot of the webserver.

Answer 2

Setup the webserver so that:
You have a public directory, where your accessible files reside, say static media + index.php and so on
Have a resources directory, that is outside your public folder.
Setup the webserver to serve from the public directory
Include like this:
require("../private/header.php");

Answer 3

You could define a constant in your index file and then in your header.php you would check so this constant exists.
// check if the header.php file is accessed directly
if (!define('MY_SECRET_CONSTANT')) {
exit();
}

Answer 4

You can either work with htaccess to ensure that special files are not viewed. The same can be achieved through a virtualhost entry.
A best pratice is to create a /web folder which is "the root" for your application and store everything which should be accessable. Other folders go anywhere else and are included into scripts which are desgined to get accessed by the user.
Your structure could look like this:
/var/www/mySite/inc/header.php
/var/www/mySite/web/index.php (including ../inc/header.php)
/var/www/mySite/web/css/style.css
Your apache virtual host would look like this:
<VirtualHost *:80>
ServerName www.mysite.com
# Basic stuff
DocumentRoot "/var/www/mySite/web"
DirectoryIndex index.php
<Directory "/var/www/mySite/web">
AllowOverride All
Allow from All
</Directory>
</VirtualHost>
Now the inc folder cannot be accessed through your domain as your web folder is the root for everyone comming from the url. Your scripts on the other hand can of course navigate lower than that and including scripts from anywhere.

Answer 5

As you can see from the answers: there's a gazillion ways to do this, here's two pretty simple ones that do not require you to change your directory structure:
In index.php and other files that include header.php:
define('INCLUDED', true);
require 'header.php';
In header.php:
if(!defined('INCLUDED')){
die('Forbidden'); // or you could redirect to home ... whatever you want :)
}
Alternatively, you can forbid access via .htaccess. Thus, you don't even have to touch your code:
<Files header.php>
order allow,deny
deny from all
</Files>
If your includes are all in one directory, you can simply deny access to that directory.