Why is it a good practice to remove PHP files from the htdocs/public directory?
They are being parsed anyway, right?
Why is it a good practice to remove PHP files from the htdocs/public directory?
Share
Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
Why is it a good practice to remove PHP files from the htdocs/public directory?
They are being parsed anyway, right?
Yes, they are parsed. However, that is completely dependent on you or the server admin not screwing up the config files.
All it takes is a quick typo in the Apache config before Apache forgets to parse the PHP (I’ve had this happen). Since Apache won’t know what to do with a PHP file after that, your source code just gets output as plain text, and can be immediately copied. Heck, it’s even cached in the user’s browser, so a malicious user can quickly copy all your code and browse it later at their convenience, looking for security holes.
You don’t want your source to be visible even for a second. If you have no code files in the htdocs directory, this can’t happen. They can easily be included into your code from outside the directory however.
Many MVC frameworks use this method of sandboxing for just this purpose.