hiding my db connect script

[dessie1981]

Hi everyone,

I have a db connect script and for testing purposes i have it in the same dir as the rest of my files that i want apache to serve. I know this is not good security.

The problem is that when i move this script to a /home folder and change the require path in my progs that use the db_connect script i cannot access the script.

Anyone any ideas??

 

[sleipnir214]

Does PHP specify why your script can't include the file?



Want the best answers? Ask the best questions! TANSTAAFL!

 

[dessie1981]

Hi ,

Its ok i put the script in the dir where my include path is pointing at.
Is there a security risk here??


Thanks

 

[sleipnir214]

I can't say. Where did you put it?

The whole point of tucking this information away somewhere is to keep it from being easily found by a hostile entity. The best way to do this is to place the include file outside the document root of any websites.



Want the best answers? Ask the best questions! TANSTAAFL!

 

[webdev007]

// Written on each file needing a conn
// It points to the "intermediary” file conn.php
require_once($_SERVER['DOCUMENT_ROOT']."/conn.php");

// About conn.php
// Is set at root level
<?
require_once("/var/

http://www/db_conn/db.php");

?>
//what it does: Only calling a dir below root named db_conn
// db.php is the conn function

 

[sleipnir214]

I suppose that will work. But I don't understand why you have resorted to that misdirection



Want the best answers? Ask the best questions! TANSTAAFL!

 

[webdev007]

Reason is that I was not able to make the call directly.
any suggestion?

 

[sleipnir214]

There is absolutely no techical reason I know of why your main script could not include a file directly, but that file could be included from an included file.

But to get back to my original question to you:

Does PHP specify why your script can't include the file?

To clarify...

PHP should have given you an error message. What was that error message?



Want the best answers? Ask the best questions! TANSTAAFL!

 

[webdev007]

No error message, never got one on any server I used it
not even on my test bed.
of course you are correct for some reason I did not think about calling below root from
$_SERVER['DOCUMENT_ROOT']