PHP coding security, no direct access is this corrcet?

[bobnmo78]

I have seen this used at the top of all non parent PHP files,

 

// no direct access

defined( '_EXEC' ) or die( 'Restricted access' );

 

is this a correct way?

[GingerRobot]

A quick google search showed up that Joola uses something similar to prevent access to files which are included by others. So yes, if you are using this in the same way and defining that constant on the pages which include these files, then it will work.

 

However, i'd prefer to place files which i don't want to grant access to outside of the web root.