---
title: "Constants"
manual: "TYPO3 Explained"
version: "main"
permalink: "https://docs.typo3.org/permalink/t3coreapi:globals-constants@main"
source: "ApiOverview/GlobalValues/Constants/Index.rst"
rendered: "2026-09-23T17:05:17+00:00"
---

# Constants {#globals-constants}

Constants in TYPO3 define paths and database information. These values
are global and cannot be changed.
Constants are defined at various points during the [bootstrap sequence](https://docs.typo3.org/permalink/t3coreapi:bootstrapping@main).

To make the information below a bit more compact, namespaces were left out. Here
are the fully qualified class names referred to below:

Check `\TYPO3\CMS\Core\Core\SystemEnvironmentBuilder::defineBaseConstants()`
method for more constants.

****Table of contents****

-   [Security-related constant](https://docs.typo3.org/permalink/t3coreapi:security-related-constant@main)
-   [File types](https://docs.typo3.org/permalink/t3coreapi:file-types@main)
-   [HTTP status codes](https://docs.typo3.org/permalink/t3coreapi:http-status-codes@main)

## Security-related constant {#globals-constants-security-related-constant}

### FILE_DENY_PATTERN_DEFAULT {#globals-constants-security-related-constant-file-deny}

Default value of [$GLOBALS\['TYPO3_CONF_VARS'\]\['BE'\]\['fileDenyPattern'\]](https://docs.typo3.org/permalink/t3coreapi:typo3confvars-be-filedenypattern@main).

-   **Defined in:**

    `\TYPO3\CMS\Core\Resource\Security\FileNameValidator::FILE_DENY_PATTERN_DEFAULT`

-   **Example:**

    `\\.(php[3-8]?|phpsh|phtml|pht|phar|shtml|cgi)(\\..*)?$|\\.pl$|^\\.htaccess$`

-   **Available in frontend:**

    Yes

### TYPO3 {#globals-constants-typo3}

TYPO3 still has some extension PHP script files executed in global context
without class or callable encapsulation, namely [`ext_localconf.php`](../../../ExtensionArchitecture/FileStructure/ExtLocalconf.md#file-extension-ext-localconf-php)
and files within `Configuration/TCA/Overrides/`.
When those files are located within the public document root of an instance and
called via HTTP directly, they may error out and render error messages. This can
be a security risk. To prevent this, those files **must** have a security gate
as first line:

```php
<?php

defined('TYPO3') or die();

// ... your code
```

It is defined to `true` in early TYPO3 bootstrap.

> [!NOTE]
> **See also**
>
> -   [ext_localconf.php](https://docs.typo3.org/permalink/t3coreapi:ext-localconf-php@main)
> -   [Configuration/TCA/Overrides/](https://docs.typo3.org/permalink/t3coreapi:extension-configuration-tca-overrides@main)

## File types {#globals-constants-file-types}

Different types of file constants are defined in the enum
`\TYPO3\CMS\Core\Resource\FileType`. These cases are available for
different groups of files as documented in
[https://www.iana.org/assignments/media-types/media-types.xhtml](https://www.iana.org/assignments/media-types/media-types.xhtml)

These file types are assigned to all [FAL](https://docs.typo3.org/permalink/t3coreapi:fal@main) resources. They can, for
example, be used in [Fluid](https://docs.typo3.org/permalink/t3coreapi:fluid@main) to decide how to render different types
of files.

| Enum case | Value | Description |
| --- | --- | --- |
| `FileType::UNKNOWN` | 0 | Unknown |
| `FileType::TEXT` | 1 | Any kind of text |
| `FileType::IMAGE` | 2 | Any kind of image |
| `FileType::AUDIO` | 3 | Any kind of audio |
| `FileType::VIDEO` | 4 | Any kind of video |
| `FileType::APPLICATION` | 5 | Any kind of application |

## HTTP status codes {#globals-constants-http-status-codes}

The different status codes available are defined in
[EXT:core/Classes/Utility/HttpUtility.php (GitHub)](https://github.com/typo3/typo3/blob/main/typo3/sysext/core/Classes/Utility/HttpUtility.php).
These constants are defined as documented in
[https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml](https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml)