Re: Hiding .inc

Christopher W. Curtis writes: > William S Poarch wrote: > > > > We're setting up a site on a virtual server that includes data we want to be > > secure in .inc files. > > What is the best way to keep these files from being able to be accessed by > > people who might be looking for security holes? > > Rename them .php > > Chris This method seems a bit subject to error--it is conceivable that the site maintainers could commit an oops and not have .php files parsed by PHP, if only briefly (say, right after an upgrade). In Apache, you can use the <Files> directive to prohibit direct access to files named *.inc, or you can simply put all of the *.inc files outside of the web server root (set up the include paths for this). Then, no matter what happens, clients won't be able to access them. -- +----------------------------------------------------------------+ |Torben Wilson <torben@php.net> Netmill iTech| |http://www.coastnet.com/~torben http://www.netmill.fi| |Ph: 1 250 383-9735 torben@netmill.fi| +----------------------------------------------------------------+