On Thu, February 15, 2007 10:11 am, Jon Anderson wrote: > Easy answer: deny access to them. Use your web server to prevent > execution of the files. Generally, if you're using Apache, you can > just > do this: > > <Directory /path/to/modules/> > Order Allow,Deny > Deny From All > </Directory> > > You may also be able to do that from a .htaccess file. It's easy to get "bit" by this if you move your application over, and forget to include the .htaccess file in your tarball, as: tar -cvf export.tar * does NOT include .htaccess file :-( I've had it happen. I was lucky enough that the whole thing didn't work, as there were other .htaccess settings that made it immediately apparent things were not right. But if all you have in .htaccess is the blockage of the PHP scripts you don't want exposed, you could all too easily mess this up in a server move. There is no real reason for the include files to be in the web tree at all. They are NOT web documents, there should never be a URL that resolves to them, for anybody. Just move them out from the web tree completely, and breathe easier is my advice. -- Some people have a "gift" link here. Know what I want? I want you to buy a CD from some starving artist. http://cdbaby.com/browse/from/lynch Yeah, I get a buck. So? -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
