How to detect and prevent including from anothers?
My database (of a phpBB version 3 forum) was bogus data / garbage. I am using shared hosting with many people. I read apache log file and saw a man (script kiddie) who had an account on the same server hosting with me, included my config.php and inserted random text overwrite my topics, my users,... so that the forum was not able working correctly.
I used Zend Guard to encrypt the config.php but he still included successfully. My hosting provider said that they cannot config to prevent "local-hack" 100% because server have PHP4 and PHP5 concurrent (many customers remain to run PHP4 script).
Could I have some lines of codes in config.php to detect and prevent including to get variables value? I can include my config.php certainly.
Thank you very much.
One way, and I'm sure there's better, but create a random string or hash, and;
|All times are GMT. The time now is 08:04 AM.|
Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.1.0