blocks|key|5189208|text|PHP可以在其限制范围内包含服务器上的任何文件。在这种情况下，您的计算机就是服务器。这不是安全问题，因为远程服务器无法访问您的文件系统。|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|5189209|entityMap^0|L|1B|0^^$0|@$1|2|3|4|5|6|7|H|8|@$9|I|A|J|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|K|8|@]|D|@]|E|$]]]|G|$]]

PHP can include any file on the server within its jailed limits, if any. In this case your computer is the server. It's not a security issue, since a remote server has no way of accessing your file system.

blocks|key|4706830|text|在我的电脑上|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4706831|可以要求任何php文件吗？|blockquote|4706832|4706833|4706834|运行PHP程序的用户有权访问的任何文件。(也就是说，文件系统权限)。|4706835|如何预防|4706836|？|4706837|4706838|4706839|限制文件系统的权限或chroot服务器，使其在沙箱环境中运行。(我不知道在Windows上是否可以使用chrooting+)|4706840|4706841|它对于web服务器不应该是安全的。|4706842|4706843|4706844|它是完全安全的，除非：|4706845|允许不受信任的用户在您的PC上安装他们自己的PHP程序(但也请参阅What+do+you+recommend+for+setting+up+a+shared+server+with+php)|offset|length|4706846|You+|unordered-list-item|4706847|4706848|允许通过未筛选的用户输入选择文件系统上的文件路径|4706849|4706850|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/questions/176013/what-do-you-recommend-for-setting-up-a-shared-server-with-php^0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|X|1P|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|1G|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|1H|8|@]|9|@]|A|$]]|$1|E|3|-4|5|6|7|1I|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|1J|8|@]|9|@]|A|$]]|$1|G|3|H|5|6|7|1K|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|1L|8|@]|9|@]|A|$]]|$1|K|3|L|5|D|7|1M|8|@]|9|@]|A|$]]|$1|M|3|-4|5|6|7|1N|8|@]|9|@]|A|$]]|$1|N|3|-4|5|6|7|1O|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|1P|8|@]|9|@]|A|$]]|$1|Q|3|-4|5|6|7|1Q|8|@]|9|@]|A|$]]|$1|R|3|S|5|D|7|1R|8|@]|9|@]|A|$]]|$1|T|3|-4|5|6|7|1S|8|@]|9|@]|A|$]]|$1|U|3|-4|5|6|7|1T|8|@]|9|@]|A|$]]|$1|V|3|W|5|6|7|1U|8|@]|9|@]|A|$]]|$1|X|3|Y|5|6|7|1V|8|@]|9|@$Z|1W|10|1X|1|1Y]]|A|$]]|$1|11|3|12|5|13|7|1Z|8|@]|9|@]|A|$]]|$1|14|3|-4|5|13|7|20|8|@]|9|@]|A|$]]|$1|15|3|16|5|6|7|21|8|@]|9|@]|A|$]]|$1|17|3|-4|5|6|7|22|8|@]|9|@]|A|$]]|$1|18|3|-4|5|6|7|23|8|@]|9|@]|A|$]]]|19|$1A|$5|1B|1C|1D|A|$1E|1F]]]]

<blockquote>
 can php require any php file in my pc?
</blockquote>

Any file that the user whom the PHP program runs as has permission to access. (That is to say, filesystem permissions).

<blockquote>
 how to prevent?
</blockquote>

Limit the permissions on the file system or chroot the server so it runs in a sandboxed environment. (I've no idea if chrooting is possible on Windows)

<blockquote>
 it should not safe for web server.
</blockquote>

It is perfectly safe unless either:

<ul>
<li>You allow untrusted users to install their own PHP programs on your PC (but see also <a href="https://stackoverflow.com/questions/176013/what-do-you-recommend-for-setting-up-a-shared-server-with-php">What do you recommend for setting up a shared server with php</a>)</li>
<li>You allow file paths on your filesystem to be selected via unfiltered user input</li>
</ul>

blocks|key|4706865|text|你可以拒绝使用.htaccess文件访问目录，因为你是用Apache运行php的。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|4706866|如果你想阻止对整个includes文件夹的直接访问，你可以放置一个.htaccess文件(该文件只有扩展名，没有文件名。您可以使用记事本键入代码，并将其保存为".htaccess“和引号，称为绝对命名)的文件夹中包含；|4706867|deny+from+all|code-block|syntax|javascript|4706868|如果你想禁用目录列表，这里有一个教程：|4706869|4706870|你可以参考这个堆栈溢出问题|4706871|只需谷歌文件夹访问拒绝使用htaccess，你可以找到很多东西。|4706872|entityMap^0|7|9|0|X|9|0|0|0|0|0|D|8|0^^$0|@$1|2|3|4|5|6|7|V|8|@$9|W|A|X|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|Y|8|@$9|Z|A|10|B|C]]|D|@]|E|$]]|$1|H|3|I|5|J|7|11|8|@]|D|@]|E|$K|L]]|$1|M|3|N|5|6|7|12|8|@]|D|@]|E|$]]|$1|O|3|-4|5|6|7|13|8|@]|D|@]|E|$]]|$1|P|3|Q|5|6|7|14|8|@]|D|@]|E|$]]|$1|R|3|S|5|6|7|15|8|@$9|16|A|17|B|C]]|D|@]|E|$]]|$1|T|3|-4|5|6|7|18|8|@]|D|@]|E|$]]]|U|$]]

You can deny access to a directory using <code>.htaccess</code> file since you run php with Apache.

If you want to block direct access to the whole includes folder, you can put a <code>.htaccess</code> file (the file has only extension, and no filename. You may use notepad to type code and save it as ".htaccess" with quotes, called absolute naming) in that folder that contains;

<pre><code>deny from all
</code></pre>

If you want to disable directory listing, here is a tutorial:

<a href="http://viralpatel.net/blogs/htaccess-directory-listing-enable-disable-allow-deny-prevent-htaccess-directory-listing/" rel="nofollow noreferrer">Directory listing in htaccess. Allow, Deny, Disable, Enable Directory Listing in .htaccess</a>

and you may refer this Stack Overflow question <a href="https://stackoverflow.com/questions/4201927/htaccess-deny-access-to-folder">.htaccess deny access to folder</a>

Just Google for folder access deny using <code>htaccess</code> and you can find lots of stuff.

can php require any php file in my pc? 

I set the apache www root folder to be d:\phpnow\htdocs, I thought that php can only require php files under this folder before ,such as require('laji/hello/a.php'); 
today I found it php can load any php file in my PC ,only need the full path. 
how to prevent ? it should not safe for web server. 

<img src="https://i.stack.imgur.com/kZC30.png" alt="enter image description here">

can php require any php file in my pc?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

在我的电脑上php可以要求任何php文件吗？我将apache www根文件夹设置为d:\phpnow\htdocs，我之前以为php只能需要这个文件夹下的php文件，比如require('laji/hello/a.php')；今天我发现php可以加载我电脑里的任何php文件，只需要完整的路径即可。如何预防？对于web服...

问在我的电脑上php可以要求任何php文件吗？
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在我的电脑上php可以要求任何php文件吗？EN