Question

I have a php applicaiton and i’m planning to keep critical settings in a .ini file. However, i think that file can be accessed from over the web, so where is a “standard place” for it to be placed?

Answer 1

You can store it above the document/web root or specifically block access to it. For example, a common structure for PHP applications is:

application/
public/

Where public is the web root – so I usually store application configuration in application/config where I know it can’t be accessed.

An alternative would be to block it using Apache:

<!-- Block access to all .ini files -->
<Files ~ "\.ini">
    Order deny,allow
    Deny from all
</Files>