php - How to protect files from outside? -

I have made a very small CMS myself after the session is set up.

CMS includes some images, PHP pages, etc.

In these pages, forms may also be included to add data to the database.

The problem now is that you can actually use an address to get the page that shows the form, that is to say;

domain.com/mycms/includes/addpage.php

How would you suggest to protect it?

Note: When I'm logged in, everything should work, just can not show this form from outside. I can check that session is present but I wonder what better and better There are easy ways.

First of all, if you are including PHP files, then You should not have them inside your public web root.

If this is not possible, then an alternative approach would be to define an absolute in your index.php (assuming that you call it as a main entry point Use) and are checking that every single file is set to prevent direct access to these files.

For example:

  // index.php: define ('INDEX_LOADED' is true); // /includes/addpage.php: If (defined! ('INDEX_LOADED')) ('no direct access is permitted');