I think you may have some common code to write for most of the PHP pages. So instead of keep a copy at each PHP file, it is better to move them in a separate PHP file e.g. common.php. So if there are something needs to be added or changed, you don’t have to go through quite a number of PHP pages, rather, you can use modify this common.php.
However, you probably don’t want people to find out that you have included this special file. e.g. You don’t want people to visit this common.php in the URL bar. So what you can do is to define a constant or whatever variable in your main PHP file and check the existence of this variable or constant in common.php. You can define constant in PHP like this:
define('AUTHOR', 'zlai');
and in common.php you can check the constant.
if ((!defined('AUTHOR'))||(constant("AUTHOR") != 'zlai'))
{
header("http/1.1 404 Not Found");
die();
}
So, if you directly type in common.php in the browser URL, you will get a 404 page not found error instead of blank page (interpreting the file).
The disadvantage is that if you have to put declaration of this special constnat before putting require(‘common.php’) or include(‘common.php’); on every page that can be accessible in the browser bar, if not, you will get 404 errors.
A better way is to avoid the constant/variable declaration. Instead, just check the special constant __FILE__ which returns the filename in this case, it is common.php and the server variable SCRIPT_FILENAME which is the filename in the URL. If these two are the same, then you can forbid the access.
if (__FILE__ == $_SERVER['SCRIPT_FILENAME'])
{
header("http/1.1 404 Not Found");
die();
}
To customize the 404 page, you can further do this:
if (__FILE__ == $_SERVER['SCRIPT_FILENAME'])
{
header($_SERVER['SERVER_PROTOCOL'] . ' 404 Not Found');
exit("<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\r\n<html><head>\r\n<title>404 Not Found</title>\r\n</head><body>\r\n<h1>Not Found</h1>\r\n<p>The requested URL " . $_SERVER['SCRIPT_NAME'] . " was not found on this server.</p>\r\n</body></html>");
}
This looks like the following if you type in accidentally the file (you don’t want others to visit directly) in the browser:
You may also consider putting these two in the common.php which controls the error reporting.
error_reporting(0); // do not report errors.
ini_set('display_errors', 'Off'); // don't display errors in the browser
The output content produced by PHP sending to browser can be compressed by apache module, e.g. gzip or deflat. However, if in your php.ini configuration file, if the zlib.output_compression = On then calling ob_start(‘gz_handler’) will give a warning saying that you basically can’t use both.
The server variable HTTP_ACCEPT_ENCODING (sample value is a string e.g. gzip,deflate,sdch) that basically says that which encoding the server accepts. You can also find this value using phpinfo(); function that will generate the HTML report of the current apache and PHP related configurations settings.
So we have to check this as a precaution for the gzip feature.
$__iszlib = (integer)ini_get('zlib.output_compression');
if ($__iszlib == 0) {
if (substr_count($_SERVER['HTTP_ACCEPT_ENCODING'], 'gzip')){
ob_start('ob_gzhandler');
} else {
ob_start();
}
} else {
ob_start();
}
The ob_start() is a useful function to send the output first to the buffer until the page ends or other buffer related functions such as ob_end_flush().
–EOF (The Ultimate Computing & Technology Blog) —
loading...
Last Post: Stop Angry Bots such as 360Spider to Crawel My Site
Next Post: NUC Hardware Review: Raspberry PI B Plus Model
