PHP file security

[Anon]

All of the pages on my site end either in .phtml or in .php. However if I have a php page with sensitive information on it (database names and passwords) it can be accessed via a web browser if instead of entering:

mysite.com/page.phtml, you enter: mysite.com/page.html

When this happens the php isn't parsed and my code is righ there mixed in with the html for all to see. I'm hoping there is a way to do this via .htaccess or something like that as I do not have direct access to my server. Thanks in advance.

Robert

[mithril]

I'm a bit confused as to what you are asking.

If you upload page.phtml to your server and it has username/passwords in it, calling page.html isn't going to show me the unparsed PHP code from page.phtml unless you've uploaded a copy of page.phtml as page.html...... they're 2 completely separate files after all. If all your files use either the .php or .phtml extensions, trying to load page.html is going to give me a 404 error.

Does this answer your question? If not, please repost the question explaining exactly what's happening on your server.

geoff

[amcgrath]

Geoff is right, you are a lil unclear, but one thing you should consider is moving files that have sensitive data off of your document root, and include them from a dir behind the doc root...

[Anon]

Sorry for the ambiguity of the first posting. Appearently the problem that I experienced was not properly communicated to me by the customer. Thanks for the help though.

Robert