0

I am developing a internal website and it has no domain (DNS not configured for domain name) so it is just accessed via internal IP address.

I have read that it is a good idea to keep backend files such as php files that connect with the database out of the documentroot and put it one level above. My structure is currently something like this:

/Website Main Directory
    /Backend (contains header.php, footer.php, login.php, logout.php)
    /Public (index.php, *.css, *.js, *.images)

Apache Virtual host directory points to this Public folder.

My index.php has include header.php and footer.php which works good and all the files in the public folder works as supposed to.

In my header I have a login form which calls login.php but the problem is login.php is located in the backend. Html can't do what php does which read's the backend files, so it will just throw me a 404. How can I make the html access the login.php in backend folder which is out of the documentroot folder.

Update:

I have tried to include the whole backend folder path but it still says login.php was not found when I submit my form:

    <header>
        <div class="headerblackbar">

            <?php 
                    session_start();
                    include '/var/www/html/.../.../login.php';
                if (isset($_SESSION['loggeduser'])) {
            ?>

            <div class="Loggedin">
                    <div class="uname">
                        <?php echo $_SESSION['loggeduser']; ?>
                    </div>

                    <form action="logout.php" method="post">
                        <div class="logoutbtn">
                            <button class="logoutbtnc" name="logout-submit" type="submit" id="logout-submit">Logout</button>
                        </div>
                    </form>
            </div>

            <?php
                } else {
            ?>

            <div class="loginform">
                <form action="login.php" method="post">
                    <div class="uname">
                        <input placeholder="Username" name="username" id="username" type="text" style="float: left;" required>
                    </div>

                    <div class="pwd">
                        <input placeholder="Password" name="password" id="password" type="password" style="float: right;" required>
                    </div>

                    <div class="loginbtn">
                        <button class="loginbtnc" name="login-submit" type="submit" id="login-submit">Login</button>
                    </div>

                </form>

            </div>

            <?php
                }
            ?>

        </div>

    </header>
  • Modify your PHP include path so it contains the full path to the Backend folder in addition to whatever path it may already contain. – Dave Jan 31 at 13:08
  • The problem with PHP files in the document root is that they may get misconfigured to serve as text and the source code for them can become visible to web site visitors. For an internal web app, that isn't usually a security concern. – Stephen Ostermiller Jan 31 at 13:38
  • 1
    Do not submit form to login.php file which does not exist in Public directory. Post data to index.php?action=login and in index.php try including login.php for this very action. This could be done with switch ($_GET["action"]) { case "login": include "../login.php"; break } – DevilaN Feb 1 at 8:27
  • @DevilaN please post that as an answer – Stephen Ostermiller Feb 1 at 9:23
  • This all sounds a lot like security through obscurity. Even if you keep your "protective measure" in place, consider writing code such that revealing it would not harm your security. – Zdenek Feb 1 at 19:16
2

Do not submit form to login.php file which does not exist in Public directory.

Post data to index.php?action=login and in index.php try including login.php for this very action. This could be done with

switch ($_GET["action"]) {
    case "login":
        include "../login.php";
        break;
    case "anotheraction":
        include "../otherfile.php";
        break;
}

Using method like this you can define multiple actions and include different files.

If you like to do it in more professional manner, then:

  • Use mod_rewrite to redirect all requests to index.php
  • Use so called routing in PHP
  • Start using some framework or microframework. Most of dirty job is done by someone else so you can focus on actual coding. Most of framework also promotes good practices in documentation so you can create better code.\

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.