5

I'm able to load static PHP files for my theme without any problems but do I name the file as file.php or file.inc? I found out that either way works fine so which one is better?

<?php include ".." . base_path() . path_to_theme() . "/includes_folder/file.php"; ?>
<?php include ".." . base_path() . path_to_theme() . "/includes_folder/file.inc"; ?>

Remember that the files are saved in my theme folder since I'm not making a module. It's just static content.

Improve this question
6

The extension ".php" is used for template files, whose extension is really ".tpl.php" files that are included from other files, such as module files, should use the ".inc" extension.

Drupal 8 uses .php (not ,tpl.php) for templates and PHP files containing classes, but still uses .inc for files loaded from modules, such as path.inc.

Improve this answer
8

The Drupal 7 coding standards (#includes) seem to use ".inc" over ".php". If you browse the Drupal Core you see ".inc" is used everywhere. I suggest you stick to ".inc".

Improve this answer
1
  • I think that .php files should be reserved only for rare cases where you would like to call the file directly from a browser – Jeremy French Aug 1 '11 at 12:28
1

As others have answered I suggest you stick with the coding standards set out by Drupal.

Make sure to protect your files though: .inc files called directly from the browser may not be pre-process by php and therefore your source code will passed straight to the user. This may already be done for you by Drupal at a high level, or may not be required due to webserver configuration.

Lastly consider checking inside each of your .inc files that they are not the entry point, devious users might cause unexpected behaviour.

Improve this answer
3
  • What do you mean by entry point? – enchance Aug 10 '11 at 6:47
  • 1
    No need extra protection. Drupal .htaccess: # Protect files and directories from prying eyes. <FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(\..*|Entries.*|Repository|Root|Tag|Template)$"> Order allow,deny </FilesMatch> – swan Apr 19 '12 at 3:00
  • @enchance Usualy .inc files are not called directly in the URI, they are included by a .php file. I have a check in my .inc files that stops the script if a variable (set by the calling .php file) is not set. This prevents accidental or malicious access. Having said that swan has pointed out another solution which seems better. – Craig Apr 20 '12 at 7:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.