Re: [PHP4BETA] PHP.INI -> PHP.PHP should we rename?

admin writes: > It struck me that with the ini file in the root of a users web site it > might be advisable to provide some protection from hackers. By giving > it the name of a script it would be possible to prepend/append > sufficient code to display a naughty-naughty message but not expose the > contents as a text file. > > Just a thought, > joe As per the INSTALL file, php.ini will be looked for by default in /usr/local/lib, safely out of the web tree. I can't think of any particularly good reasons to put it into the web tree. You can change this default location when you compile PHP (I forget the actual option; try ./configure --help). If you have files in a directory on a(n Apache) server for which you cannot access the setup files, you can still tell Apache not to serve those files. For instance, if I had a site with some *.inc files which couldn't be located outside of the web tree, I could do this in that directory's .htaccess file: <FilesMatch "\.(inc)$"> Order allow,deny Deny from all </FilesMatch> Of course, the server admin can also set things up so that this isn't allowed either, so YMMV. It'd be more efficient to do this from httpd.conf anyway, and there seems to usually be a way to have sensitive files located outside of the document root. Cheers, Torben -- +----------------------------------------------------------------+ |Torben Wilson <torben@php.net> Netmill iTech| |http://www.coastnet.com/~torben http://www.netmill.fi| |Ph: 1 250 383-9735 torben@netmill.fi| +----------------------------------------------------------------+