Re: Prevent security bypass

["Ernie Nelson" <Juridian () juridian com>]

A simpler method that requires less work is to simply name your include with
the .asp extension.  If you feel the need to mark it as an include prefixing
the filename with inc_ (such as inc_secure.asp).  That way even if the
directories aren't configured right, the code is stripped out and harmless.


> I know I'm going to catch sh!t here cause I used .inc, but you can easily
> mitigate this by turning off read access in IIS to directories that only
> hold files included by other files (such as /scripts/)