I assume you mean that it *can't* read it. Which is normal; iframes are client side technology, so by giving it a source it needs to be resolvable via http, not filesystem access. PHP on the other hand isn't limited to this, so if you have a script accessible by the client, it can load outside of the public_html.
There's not a whole lot you can do to prevent direct access via url. Since this is a separate request by the client, you can't do things like constants or variable setting since they are outside of the primary page request.
What you can do is use disposable token requests assuming the primary page and the one in the iframe are both local. This involves simply setting a token for a request, and then the code in the frame retrieves, compares and consumes a token via a get request.
For a really basic example:
PHP Code:
<?php
session_start();
// just something to make it unique and randomish.
$_SESSION['requestToken'] = sha1(uniqid(''));
printf('<iframe src="mypage.php?requestToken=%s"></iframe>', $_SESSION['requestToken']);
Then on mypage.php:
PHP Code:
<?php
session_start();
if (isset($_GET['requestToken']), $_SESSION['requestToken']))
{
if (strcmp($_GET['requestToken'], $_SESSION['requestToken']) == 0)
{
// this here says everything is fine and matches up.
unset($_SESSION['requestToken']);
// do whatever else
}
else
{
die('Invalid access token');
}
}
else
{
die('Invalid access token');
}
Untested, works alright in my "upstairs library".
Before you post, read our: 
