storing database fileson server and protecting the directory

[matt sheeyd]

Hi,
I need some information on where to store db connection details in php on my server. Currently all the files are in the httpdocs folder. Is it safe to have the db conn file in there? I was thinking of putting the files into another directory with a htaccess file that denies from all users except my scripts. However i have tried
[code]
#Deny access for all users (all IPs), except the same domain IP
Order allow,deny
deny from all
allow from xxx.xxx.xxx.xxx
ErrorDocument 403 /403.html
[\code]
and all i get is 403 errors. Is it possible to deny access when the url is directly typed in but still allow my own scripts to get through?

Thanks matt.

[dlite922]

your script is accessing the file locally. It is not call it on port 80 through apache. That "allow from xxx.xxx.xxx" is for clients that connect to the webserver.

Just don't serve the file. Put it outside the webroot directory. Your script can access it, but apache won't serve it.

If you must leave it, you can hide it in PHP code (i.e. if someone types that page in it will just show nothing or whatever message you choose to echo). This means the file MUST be processed. It cannot be a text or .inc file.

Hope that answers your questions,

DM