Re: Hiding the source!

On Thu, 17 Aug 2000, Paul Burney wrote: > on 8/17/00 10:34 AM, Brian T. Allen (brian@purenetfx.com) wrote: > > > Another way, with probably the same result (except that the information > > wouldn't be parsed) is to add .inc as an extension that won't be displayed > > by apache (just like .htaccess is). So even if they type in the URL apache > > still won't serve it up. By far the best is to put the includes outside the > > web directory. > > That's a good idea so that people won't be able to see include files at all. (snip) > If the file is in a special include path, they just need to call phpinfo(). > > So just be careful if you let other users add pages to your site. This could be discouraged to a limited extent by making all include paths specific to the user or directory tree, either by defining it in <UserDir> in Apache, with .htaccess, or perhaps by VirtualHost (my preference). Still, it's hardly a reliable solution. Matt