Some PHP security tips for programmers & non-programmers

[Halfdeck]

Originally Posted by rich06

with all the scripts I develop I have all the php include files outside the web document root so they can only be pulled in by a php script and cannot be loaded up directly by a browser.

hth
rich

I used to do the same, but the problem comes when I want to move servers, although the problem can be alleviated by using config files for paths, I guess. Another problem is making multiple domains dependent on one php file.

I use classes, not bare functions, so access to a php file doesn't do anything.