[Invision User]

Is there a way to make a directory hosted on a server unaccessible but still let it be included in other PHP files?

Thanks.

[Sebastian Mares]

Wouldn't it work with a .htaccess file that denies access to all? AFAIK, PHP reads the files from disk and won't interefere with Apache.

[Invision User]

Okay, .htaccess is fine. How would I go about using that though please?

*.htaccess confuses me*

[Sebastian Mares]

Simply create a file called ".htaccess" and write the following inside it:

Order Deny,Allow
Deny from all

Store the file inside the directory you want to protect.

[Invision User]

Thank you very much.

It doesn't seem to work. o__o

[Sebastian Mares]

Do you even have Apache running as web server? And are .htaccess files parsed by your Apache?

[Invision User]

I do have an Apache server, yes.

[Brendon Koz]

You can place the folders/files BELOW your web root directory. I am doing this right now.

So, for instance, on my test machine...

C:\Apache\htdocs\*.*
The *.* are all files that are accessible, htdocs is my web root.

C:\Apache\php_secure\*.*
In this case I can still access the files one folder below (../ <-- relative url or path) but no one can view the files.

[Michael P]

Matt Pullen, on Dec 27 2005, 07:18 PM, said:

Is there a way to make a directory hosted on a server unaccessible but still let it be included in other PHP files?

Thanks.

This may not be what your looking for exactly, but I use it, and its used in IPB.

In your scripts that will use the files in the protected directory, define a variable e.g. ScriptName, then in each script you will include in another folder, get the script to check the variable is defined, if its included the variable is defined, otherwise its not and you can get it to report an error message or even redirect to an access denied page.

[_]

I'd do what malikyte says; I place all my core files in /home/veracon, then the executor and static files in /home/veracon/public_html...

[Brendon Koz]

Without losing your password or host's security being bypassed, it's the most secure method of hiding your stuff.

I do basically the same thing on our production server (Unix OS) but figured a Windows OS example would be a bit more easily understood...

[Invision User]

Okay! Thanks a bunch for that.