PHP MySQL - Stilson.net

www.it-ebooks.infoCHAPTER 21 • SECURING YOUR WEB SITEeven if the file does not have a recognized extension. However, it is not possible for a user to view a filethat resides outside of this path. Therefore, consider placing your configuration files outside of theDocumentRoot path.To retrieve these files, you can use include() to include those files into any PHP files. For example,assume that you set DocumentRoot like so:DocumentRoot C:/apache2/htdocsDocumentRoot /www/apache/home# Windows# LinuxSuppose you’re using a logging package that writes site access information to a series of text files.You certainly wouldn’t want anyone to view those files, so it would be a good idea to place them outsideof the document root. Therefore, you could save them to some directory residing outside of the previouspaths:C:/Apache/sitelogs//usr/local/sitelogs/# Windows# LinuxDenying Access to Certain File ExtensionsA second way to prevent users from viewing certain files is to deny access to certain extensions byconfiguring the httpd.conf file Files directive. Assume that you don’t want anyone to access files havingthe extension .inc. Place the following in your httpd.conf file:Order allow,denyDeny from allAfter making this addition, restart the Apache server. You will find that access is denied to any usermaking a request to view a file with the extension .inc via the browser. However, you can still includethese files in your scripts. Incidentally, if you search through the httpd.conf file, you will see that this isthe same premise used to protect access to .htaccess.Data EncryptionEncryption can be defined as the translation of data into a format that is intended to be unreadable byanyone except the intended party. The intended party can then decode, or decrypt, the encrypted datathrough the use of some secret—typically a secret key or password. PHP offers support for severalencryption algorithms; the more prominent ones are described here.■ Tip For more information about encryption, pick up the book Applied Cryptography: Protocols, Algorithms, andSource Code in C, Second Edition by Bruce Schneier (John Wiley & Sons, 1995).433