Many users place code in multiple files and include these files:
<?php
require 'functions.inc';
?>
Or perhaps
<?php
require 'functions.php';
?>
Both of these can be problematic if the included file is accessible somewhere
under the DOCUMENT_ROOT directory. The best solution is to place these files
outside of the DOCUMENT_ROOT directory where they are not accessible directly.
You can add this external directory to your include_path
configuration setting.
Another option is to reject any direct requests for these files in your Apache
configuration. You can use a rule like this in your "httpd.conf"
file:
<Files ~ "\.inc$">
Order allow,deny
Deny from all
</Files>
