note 70740 added to security

How about not putting the php code in the web-root at all...? You can create a public directory with the css, html, etc and index.php there. Then use the include_path setting to point to the actual php code, eg... webstuff phpcode public images css index.php then set the include path to "../phpcode" and, as php is executed from the directory of the script, all should be well. I'd also call the main index "main.page", or something else, instead of "index.php" and change the web server default index page. That way you cant get hit by things trawlling the web for index pages. ---- Server IP: 66.163.161.117 Probable Submitter: 82.32.132.173 ---- Manual Page -- http://www.php.net/manual/en/security.php Edit -- https://master.php.net/note/edit/70740 Del: integrated -- https://master.php.net/note/delete/70740/integrated Del: useless -- https://master.php.net/note/delete/70740/useless Del: bad code -- https://master.php.net/note/delete/70740/bad+code Del: spam -- https://master.php.net/note/delete/70740/spam Del: non-english -- https://master.php.net/note/delete/70740/non-english Del: in docs -- https://master.php.net/note/delete/70740/in+docs Del: other reasons-- https://master.php.net/note/delete/70740 Reject -- https://master.php.net/note/reject/70740 Search -- https://master.php.net/manage/user-notes.php