them in a separate directory and use the web server's access control capabilities to prevent attackers from
directly requesting them. One common practice is to define a fixed constant in each calling program, then
check for the existence of the constant in the library/include file; if the constant does not exist, then the file
was directly requested, and it can exit immediately.