5

Im creating a website and i am very OCD when it comes to security so i heard that if you store all of your .php files outside of your public_html folder and invoke them with another .php file that is inside your public_html folder then your risk of an attack is lower. Is this true, if so how would i do this. I read something about using .htaccess but I'm not sure if that was the correct way to do it. I though i could maybe use include but im not sure how include works with parameters.

  • of all the security measures you can take directory structure for php files is low. There are hosts that wont even let you put anything below the web root. –  Jul 27 '12 at 02:54
  • Thanks ill see if my host allows this. –  Jul 27 '12 at 02:58

2 Answers2

4

There isn't a huge amount of extra protection offered by this strategy. Mainly, it ensures that if your server is misconfigured and fails to send PHP scripts to the PHP interpreter, it doesn't allow PHP code to be sent directly down to the browser.

You don't store all your PHP scripts outside document root. You typically store only files which are not intended to be accessed publicly outisde the doc root. Store your include files outside the doc root and include them as you would any file. Store files which are are public views inside the document root, as they need to be web-accessible.

There is a design pattern known as the Front Controller pattern whereby a single index page (index.php) accepts routes and includes other files as appropriate. Numerous PHP frameworks support this out of the box.

Michael Berkowski
  • 267,341
  • 46
  • 444
  • 390
  • Ok, so i should only store lets say my config.php file outside and include it to get the variables? –  Jul 27 '12 at 02:57
  • @CristianRivera Yes, that's a common strategy – Michael Berkowski Jul 27 '12 at 02:58
  • Thanks for your help ill look into Front Controller Pattern that sounds pretty cool. –  Jul 27 '12 at 03:04
  • my document root is my public folder containing js files in which there is some ajax code that will call php scripts outside document root in that how can i do it? if there is no way to do it what can be done? – Linus Jun 23 '16 at 20:58
  • @AnmolRaghuvanshiVersion2.0 If you need to call PHP from ajax, you will need to have _some_ PHP file in the doc root. The web server can't serve files that aren't in the document root, so you would need some file like ajax.php in the docroot which may include/require other files outside the docroot. – Michael Berkowski Jun 23 '16 at 22:02
  • @MichaelBerkowski thanks :) it works but is this type of pratice is good or bad? – Linus Jun 24 '16 at 03:37
  • @AnmolRaghuvanshiVersion2.0 It is a fine practice, a common one. There must be some PHP exposed to the doc root to set your application in motion, but the majority of it can be hidden in outside the docroot. – Michael Berkowski Jun 24 '16 at 10:51
  • @MichaelBerkowski thanks for help i thought i have been doing wrong. – Linus Jun 24 '16 at 10:58
0

See PHP include function: http://www.php.net/manual/en/function.include.php

However, I doubt what you're trying to do will increase security. Where did you hear that it increases security?

joshhendo
  • 1,964
  • 1
  • 21
  • 28
  • Thanks for that, i cant remember where i saw that it increases security i didn't spend much time reading about it. –  Jul 27 '12 at 02:57