PHP class files.

[davidrobin]

I have a few PHP class files that I do not want users to access.
Where is the best place to put them?

[kows]

put them into an empty folder and then upload a .htaccess file with a deny from all statement.

if you don't know how to make one, just open notepad, save a file as ".htaccess" and then add this to it:

order deny,allow
deny from all

[davidrobin]

Looks good to me.

Thanks.

[visualAd]

The most secure place to put them is above the document root and chmod the file to 0660.

N.B. This may not work if PHP is an apache module.

[davidrobin]

I actually put the following lines in the httpd.conf file which worked a treat.

<Directory "C:/Program Files/Apache Group/Apache2/htdocs/classes">
AllowOverride None
Options None
Order allow,deny
deny from all
</Directory>


I take it this only worked because the server is installed on my local machine. If I was paying someone to host my site I wouldn't have that level of access so I would have to use the htaccess files.

[davidrobin]

VisualAd: What do you mean by chmod. I have seen this mentioned but thought it only related to Linux. How does it relate to Windows?

[visualAd]

Originally posted by davidrobin
VisualAd: What do you mean by chmod. I have seen this mentioned but thought it only related to Linux. How does it relate to Windows?

chmod is Linux only. I assumed that was what you were using. It allows you to change file permissions.

On linux apache runs as an un priviledged user and you can configure PHP to run as a different user enabling you to give PHP different access rights for files.

The equivelent on windows is editing the security descriptor on a file. However on Windows this probably won't work as apache runs as a service. I believe that when a program runs as a service it has access to the whole system. I'm not sure though.

If you are using Windows I would definatly put the script files above the document root though. e.g:

C:/Program Files/Apache Group/Apache2/classes

[davidrobin]

Thanks VisualAd.

I have been thinking of installing Linux on an old machine I have at home. It seems a lot of work compared to widows. More maintenance that is, everything takes twice as long to install or configure. Thats as much as I can say about it though.
I tried installing SUSE 6 once but a few of my hardware components were not compatible so I had to abandon it. I believe recent version are a lot better.

Also it takes so long to download, time and bandwidth are something I don't have at the moment.

I will have to give it a bit more thought.

[visualAd]

Once it's up and running Linux requires a lot less attention than Windows.

I have a Linux Server and it just sits there minding its own business - doing what it's supposed to do. The easiest way to get Linux without having to download it is to buy a Linux Magazine. They often come with full distributions. A couple of months back Linux Format came with Mandrake 9.2. Not only that if you buy the magazine you also get a bit of support installing it..

My advice would be to get an old system together and install Linux as a server and play around. The hardware that usually causes the problems is modems and graphics cards. If you are not interested in graphics though you can just choose to have a simple text console. In my opinion an MS-DOS like CLI is a lot more friendly that having to navigate through hierarchies of menus and complex GUI's.