Site Security, Best location for connection files

shortone · 2 Dec 2008 at 20:14

Hi Guys,

I am aware that I have some connection files such as db.php that contain passwords and logins sat in folders on my site. Whats the best way of making sure they cant be accessed by hackers ? Is it simply a case of chmod 644 on each file ?

t31os · 3 Dec 2008 at 17:33

I'm actually interested in this to....

Googling stuff now, this seems the most useful link found so far...

http://www.tellinya.com/read/2007/08/06/47.html

RobH · 3 Dec 2008 at 17:40

This might also be useful for general PHP security: http://php.robm.me.uk

Written by our own rob miller

Craig321 · 3 Dec 2008 at 17:43

shortone said:
Hi Guys,

I am aware that I have some connection files such as db.php that contain passwords and logins sat in folders on my site. Whats the best way of making sure they cant be accessed by hackers ? Is it simply a case of chmod 644 on each file ?

CHMOD 644 should be fine, but the safest way would be to put it OUTSIDE your public_html/htdocs/www (whatever your host calls your main website folder). Just stick it in a folder previous to the place where all your other files are uploaded, that way the only way someone can access the database connection file is by either logging into your account though FTP or hacking the web server.

RobH said:
This might also be useful for general PHP security: http://php.robm.me.uk

Written by our own james.miller

That's definitely a good website for security, I've used it a few times myself

Inquisitor · 3 Dec 2008 at 17:55

RobH said:
This might also be useful for general PHP security: http://php.robm.me.uk

Written by our own james.miller

robmiller actually :/

shortone · 3 Dec 2008 at 18:52

Thanks for the replies guys

RobH · 3 Dec 2008 at 19:05

Inquisitor said:
robmiller actually :/

Yeah, sorry got confused, saw the user james.miller when I was searching for that link and it threw me off.

fini · 3 Dec 2008 at 19:08

Put them in your root (www) directory and chmod them to 777

shortone · 3 Dec 2008 at 19:26

Code:

Put them in your root (www) directory and chmod them to 777

What and publish the login and password on the home page as well ;-)

fini · 3 Dec 2008 at 19:44

No that would just be silly!

fishfishfish · 3 Dec 2008 at 19:46

What I do is place config files below the www directory. This means that they can't be viewed from a browser at all. If your FTP access allows it, you can set it up like this:

/home/yoursitename/
/includes/ - Confidential stuff goes in here
/www/ - Website goes in here

Then, just set up your scripts so they access the content that's stored below the www directory. The right chmod permissions are also a good idea generally.