If your hosting allows it you should move the file with the settings in it above the folder that the web site is in. That way it will only be accessible from PHP and not directly.
You can also place code in the file itself that tests whether it is being called or accessed directly and which disallows direct access.
Another file(s) in your script would have the following in it, thus telling your database connection file, it is being included in an approved file.
define('ACCEPTABLE', true);
However, I will say, that isn’t fool-proof. To make it better, I’d follow @felgall ; initial advice. Place the database connection file outside of your web directory and include it using an absolute path.
Okay, assume you have an index.php, that “includes” the database connection file.
Your index.php would have the following:
define('ACCEPTABLE', true);
Your database connection file would have (should be at the top of the file):
if (!is_defined('ACCEPTABLE')) exit;
Since index.php has defined ACCEPTABLE, the include for database_connection will complete.
If you had another page, let’s call it article.php, that DOES NOT define the ACCEPTABLE constant and tries to include the database connection file, the database connection file will exist at the IF check and not load the entire file (so the database connection won’t be available to article.php.
Second part:
I’m not sure what WEB_ROOT is used for, but you’d only “have” to move your database connection file outside of your httpdocs, although it doesn’t hurt to move anything that is used in an include (everything, except your index.php, articles.php – which are web facing files).
Okay, I get what you were saying, but I’m still not following how this makes things more secure?
It almost sounds like you are trying to handle a scenario where a hacker uploaded their own file or something?
Can you please explain the overall logic of this more?
It is what it says it is.
It is a constant that defines where my Web Root is on either my local dev environment or on my production environment. (I usually prepend that to relative paths so things point to “one source of truth”.
Right, and that is what I showed in my last post…
Currently, GoDaddy defines your VPS WEb Root like this…
Yes, it is to prevent a scenario where someone uploads a file and tries to include your database connection file (or directly access it via HTTP). Granted I’m not a huge fan of this technique myself, primarily because it isn’t nearly as protective as the other technique.
Yes, assuming httpdocs is the external facing directory inside MySite.com and MySite.com is not the external facing folder itself (so files inside MySite.com but not inside httpdocs are not accessible via http://MySite.com/.
So generally if someone tries to go to “http://your-domain.com/secret-database-info.php” they wouldn’t see the code (just output if any.).
But if for some reason the PHP engine fails to run the file, they’ll see the text in all it’s glory.
That most likely won’t happen, but if “secret-database-info.php” is outside of the root, your site’s script can get it but a direct HTTP request for it is impossible.
The use of “DEFINE(“my-sites-file”, TRUE)” is often used so that a direct HTTP request for a “secret-database-info.php” file that is under the root will exit. And for the most part this is secure, but having the file outside of the root is more secure.
I have to re-check with GoDaddy, but I am 90% certain that MySite.com/ is my VPS’s directory and that anything inside of it is NOT outward facing. And that you have to have files inside of MySite.com/httpdocs/ for them to be outward facing.
Let me see if I understand what you and CPRadio were talking about…
First, Mittineague, if my “database_settings.php” file was in the Web Root, would this code help to prevent it from displaying the actuals settings if some tried to load “www.MySite.com/database_settings.php”…
configuration/config.php
define('LOAD_FILE', TRUE);
database_settings.php
if !(LOAD_FILE){
exit();
}
And as far as what CPRadio suggested, would this code work…
configuration/config.php
define('LOAD_DB_SETTINGS', TRUE);
display_member_listing.php
if !(LOAD_DB_SETTINGS){
exit();
}
(I guess I didn’t quite get the need for is_defined…)
That’s really a question you have to answer. Think of it this way: “If someone got a hold of this, would I care? Would it give them some knowledge about my system that I don’t want them to know?” If you answer yes, then you need to protect it the best you can, otherwise, leave it be.
If my config.php in inside my Web Root and it got exposed, then hackers would know the location of my “secure_directory_outside_web_root”.
And if they knew where that directory was, then wouldn’t that make it easy to hack into that folder, thus threatening the new location of my database_settings.php file??
I need to place my Database Settings in a not_in_web_root_directory for security, but…
I need a Config file to define where my not_in_web_root_directory is at, and…
If I place the Config file in the not_in_web_root_directory location, then my scripts in the Web Root can’t see it to know where my Database Settings are at?! (:
Your scripts should be able to locate it and use it (via an absolute path, /home/user/MySite.com/mysecretfolder/config.php). It won’t be accessible via HTTP requests though, which is a good thing.