[RESOLVED] file security

[cass27]

Hi
I am relatively new to php and I am aware I need to keep my files secure. Especially those that contain the password and username etc to my hosts database.

I have placed this in a file called connect.php and used include() to include it on relative pages. But I have also read that these files should be outside of the "normal directory Tree". I am not sure what this means or how I can do this. At the moment all the files in the directory are under http docs. The connect file is within an include folder. Is this safe enough?

thanks for your help

cass27🙂

[coldwerturkey]

if your server is like

/webroots/htdocs/www/(all files/folders here are public via a domain/ip)

putting the include file above /www (ie; in /webroots or /htdocs) prevents anyone without server access from being able to access it

[cass27]

my hosts server is like this:

/httpdocs/includes/connect.php

This is how it appears in the ftp.

so I could put it above the httpdocs. there are three folders above httpdocs: anonftp, cgi-bin and errors_docs.

At the moment where it is its path is ../includes/connect.php. If I place the folder amonst these folders what will the path become?

thanks

cass27

[bradgrafelman]

You have a few choices. You could start with an absolute path and work backwards like so:

$_SERVER['DOCUMENT_ROOT'] . '/../includes/connect.php'

or you could simply look at the path of the PHP script that is include()'ing connect.php and use a relative path. The '../' simply points to the parent of the current directory.

Otherwise you could simply hardcode the full absolute path (e.g. /home/username/includes/connect.php).