Re: how to hide dbconnect file if its in published directory?

The suggestion to use the ".php" extension instead of the ".inc" extension doesn't work. I created to identical files, swordfish.php and swordfish.inc, containing the following script: <?php define("PASSWORD", "swordfish"); ?> When I use the following lines include ('http://www.friendshipcenter.com/Objects/swordfish.inc'); echo "Your password is ", PASSWORD; it works, i.e., prints "Your password is swordfish." When I use the following lines include ('http://www.friendshipcenter.com/Objects/swordfish.php'); echo "Your password is ", PASSWORD; it doesn't work, i.e., prints "Your password is PASSWORD." I tried putting swordfish.inc in my "cgi-bin" directory, which is outside my "www" directory. I can't figure out what pathname to call it with. I.e., include ('cgi-bin/swordfish.inc'); can't find the file. As I wrote earlier, my .inc files can be read by anyone typing in the URL. It doesn't matter if there are <?php ?> lines. .inc files don't execute. I rent server space from phpwebhosting.com, so I can't change the PHP settings. Any other ideas how to hide a password file? -- Thomas David Kehoe, author of "THE EVOLUTION OF INTIMATE RELATIONSHIPS" How Our Brains Are Hardwired For Relationships http://www.FriendshipCenter.com/TEIR/