Secure Php execution on server

Question

I have a php script which updates a database. I want to be sure that no one else can call my script remotely and execute it.

I tried this code but it did not work, the refer was always empty because I use https connection.

if (strpos($_SERVER['HTTPS_REFERER'], 'linkedfilm.com') == false) 
{
    exit();
}

The server is Apache server.

Thanks.

Maybe design a RBAC. User must be logged in and of a certain role (admin for example). — Jaquarh
– Jaquarh, Commented Jan 20, 2019 at 13:53
Are you looking for this : stackoverflow.com/questions/51129624/… ? — Shan
– Shan, Commented Jan 20, 2019 at 14:15

Sebastian Waldbauer · Accepted Answer · 2019-01-20 13:45:28Z

3

You got a few options to secure this .php script.

You can secure this script by moving it into another directory outside of your DOCUMENT_ROOT
You can add the .htaccess
You can allow only local ip

answered Jan 20, 2019 at 13:45

6771 gold badge10 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Matthew Page · Accepted Answer · 2019-01-20 13:44:27Z

1

You could use .htaccess and put your script in a password protected directory.

Or you could use some sort of login and authentication routines on your site so you can login and access that script.

Or you could pass a 'secret' key with you call to the script, quick and dirty

if( $_GET['secret'] != "mysecret" ) exit();

answered Jan 20, 2019 at 13:44

Matthew Page

7465 silver badges15 bronze badges