Re: security on shared servers

From: "Andy B" <aborka1@wmis.net> > im writing this admin system for a website and need to have it write system > logs to its own log files... the only problem i can really see is that its > on a shared webserver and all files are restricted to your own domain/vhost > dirs (whatever those happen to be). the admin wont let anybody put syslogs > anywhere outside there vhost section of the server and .htaccess support is > disabled and wont be able to be turned on (so i cant deny browser requests > to a certain dir). anybody have any idea how i can protect the admin syslogs > this program has to create (that way browsers cant download the logs)?? You don't have access to anything outside of the webroot? If /home/user/www/ is your webroot, then write them to /home/user/. If you're saying you can't do that and they have to be put under the webroot, then give them .php extensions and make the first line <?php exit(); ?> Then they can't be viewed through the browser, but PHP can still read them (fopen, etc) or they can be opened with text editors. ---John Holmes...