Re: How do you keep your scripts secure?
| From: | Murph | Date: | Thu, 15 Mar 2001 23:20:48 +0000 |
| Subject: | Re: How do you keep your scripts secure? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-44167@lists.php.net to get a copy of this message | ||
> If the include file has an extension that is not recognized by the server
as
> being a "PHP" file, the server will simply serve it up as text. So, your
> file index.php is recognized as being a PHP file, it gets passed to PHP
> which parses and compiles it and returns it to the server, which passes
the
> output back to the browser. No one can see the source for this file. OTOH,
> say you have a file named database.password. The server does not recognize
> this as a PHP file, and so simply dumps the contents to the browser as
text.
> The user sees the raw contents of the file.
Yeah, that's what I kind of thought. I keep everything as *.php files so I
should be safe.
Would you agree that I can stop reading all this stuff about file
permissions and everything and begin to relax? My head hurts.
Murph