note 56407 deleted from security.filesystem by sobak

Note Submitter: joshudson';DROP TABLE EMAILS;' gmail.com ---- I keep application configuration files in the document root. I found the most effective trick to prevent access to them is to 1. Give them no code that actually runs when included (except for variable assignments), 2. Don't use register globals so nobody can do anything weird, 3. Name them *.php so PHP runs them when asked for 4. Don't have anything before <?php 5. Don't have a ?>