Name your files "*.inc.php" to prevent apache from displaying them. As
added security, keep them out of the web root and access them using
absolute paths (ie., if your webroot is /home/web/public_html/, store
your includes in /home/web/includes). If you must have your files below
your webroot, make sure to use an .htaccess file to prevent access to
the directory directly. Combine these three tactics and you should be
in good shape.
For server-level security in shared hosting environments, if your web
host supports some sort of accelerator such as eaccelerator, ioncube, or
zend encoder, encode your DB login information PHP files using that.
And, as always, proper file ownership and permissions (user:apache, 640)
are of primary importance.
- Todd
John Madden wrote:
Hi,
First off i'm not a PHP programmer but I would like to
know the following:
Is it standard to use INC files to store MYSQL db
connections settings (username and password)?
What else could you do to make this "safer" ?
I presume Apache looks for files with extention
"*.INC" and does not processes them, right ?
Thanks you
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
-------------------------------------------------------------------------
Sponsored by: Watchfire
Watchfire named worldwide market share leader in web application security
assessment by leading market research firm. Watchfire's AppScan is the
industry's first and leading web application security testing suite, and
the only solution to provide comprehensive remediation tasks at every
level of the application. See for yourself.
Download a Free Trial of AppScan 6.0 today!
https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
--------------------------------------------------------------------------
-------------------------------------------------------------------------
Sponsored by: Watchfire
Watchfire named worldwide market share leader in web application security
assessment by leading market research firm. Watchfire's AppScan is the
industry's first and leading web application security testing suite, and
the only solution to provide comprehensive remediation tasks at every
level of the application. See for yourself.
Download a Free Trial of AppScan 6.0 today!
https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
--------------------------------------------------------------------------
