Whats to stop an attacker from creating this code and using it to gain access to your database credentials?

<?php
include('http://www.url.com/file.php');
//require('');

//hack code "where user logs in, copies/adds all and deletes all, etc."

//where file.php hold credentials of your mysql database?
?>

Any help as to block this attack?

currently using referral redirect but this this is also unsecure.

Again, any help on this subject would be much appreciated.

and yes this is possible with 6 lines of code, any ideas?, as I have noticed most chat room / customization scripts are vulnerable to this.

the only other idea I seem to find that works but not effiicient is ip filtering.

1. place the config file containing the db access above the web root to avoid this

2. add some code to validate that a defined variable is there before allowing access

3. VALIDATE the data being passed to the script

4. ensure that your application validates the user and their permissions

_________________
Lostboy

Cat, the other other white meat

Please read Posting Etiquette before posting

You can always try Google