Question

When I store files that access my database, is changing the permissions on the file to 0600 enough to keep anything but other files on my server from accessing that file? I have read that one way is to store the file out of the web root directory, but will changing the permissions give you the same secure results?

Answer 1

there are a number of things you can do:

• set permissions on the directory containing the files
• set permissions on the files
• set up your server directives to mod rewrite your urls so that way only things in a “public” folder are accessible by direct linking, otherwise they must be loaded by proxy via server side code.

I prefer method 3.