title: Preventing Direct Access, is it possible to spoof a php define?
body: <p>I want to prevent direct access to my <code>header.php</code> and <code>footer.php</code> files... </p>
  
  <p>I know there are a lot of questions on SO about how to prevent direct access, but none of them really explain how secure those methods are.</p>
  
  <p>Things like the example below, seems like security through obscurity, because anyone could just set the <code>$_POST[$variable]</code>, to what ever they wanted.</p>
  
  <pre><code>if (!isset($_POST['field'])) {
    die();
  }
  
  /* AND */
  
  if (empty($_POST)) {
    exit("Direct access not allowed");
  }
  </code></pre>
  
  <p>But what about using the <code>define</code> function to prevent direct access? Is that any safer from someone setting a <code>define</code>?</p>
  
  <p>Something like</p>
  
  <pre><code>// index.php
  define("DIRECTACCESS", "NO");
  include 'header.php';
  
  // header.php
  if(DIRECTACCESS == "NO")
     die('No direct access allowed');
  </code></pre>
  
  <p>Or could i even do this:</p>
  
  <pre><code>// index.php
  $daccess = 'NO';
  include 'header.php';
  
  // header.php
  if(!isset($daccess))
     die('No direct access allowed');
  </code></pre>