Question

I know one solution is to put the .ini file outside the webroot, but I want to have a config file as part of the source tree of my webapp.

Since I want to put database passwords in it, I need to make sure its not accessible from typing http://www.drstrangelove.com/missile_codes.ini

I want to beleive there is an apache config setting for this but I don’t know what it is or what to type in google to find out.

Answer 1

You can use .htaccess for that:

<Files "*.ini">
order deny,allow
deny from all
</Files>

Or (if you want just the single .ini file): replace the * with the filename.