Home/ Questions/Q 6021613
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-23T03:44:20+00:00

I am new to web development and I’m learning PHP in order to sell

  • 0

I am new to web development and I’m learning PHP in order to sell a few binary files (shared Linux host). The site is not yet live.

My php scripts (50% borrowed code, 50% self-written, 95% fully understood) login to MySQL to READ the items for sale, and WRITE sale transaction data into another table. Functions.php, located in a subfolder of the webroot, contains the login name and password for MySQL.

Q1. This doesn’t seem secure to me. How should the login/password info be stored so the scripts can access it? If functions.php was stored outside the webroot, could the .php files located in webroot #include (PHP “require_once”) it? (I did try this once and my scripts broke in a way that seemed permissions-related — if I knew it should work I’d keep plugging away at it)

Q2. I am unsure where to store the binaries that purchasers can download. Is it correct that savvy users can somehow find / download them (without paying) if I just store them in a subfolder of the webroot? Is it possible to use a .htaccess file to block access to the “binaries” folder within the webroot? Can black-hats get at / modify a .htaccess file?

Q3. Would it be a better idea to store the binaries (max=4Mb) in a MySQL table and copy them from there to a temp file in webroot before each download, then delete?

Q4. Can anyone recommend a set of scripts that manages this sort of thing that I could review / modify rather than reinventing the wheel?

Thanks

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Not sure if best practice, but this is how I’d approach it:

    Q1: I store MySQL login information, along with local paths and other settings, in a config.inc.php file outside of the web root. I can then include that at the start of each script. I also use a database.inc.php which connects to MySQL and selects the database (plus a few database functions). In theory it isn’t insecure inside the web root as being called directly will only execute the PHP, not display the contents of it. Storing an XML config or similar is different however!

    Q2: If downloadable binaries are stored within the web root then they could be downloaded if the right URL is discovered. Instead they should be stored outside the web root, and a PHP “gateway” script serves the contents of those files if the request meets the right conditions. You may want to store a token with each purchase in your database, and only valid tokens are permitted to download the files. An example of a download script is here.

    Q3: I believe it’s better to use the file system to store files, rather than a database. It won’t improve security over my answer to Q2 if that’s what you mean.

    Q4: You could try existing shopping cart software. Magento supports downloadable products.

    Hope that helps

    • 0