Posted by dimo414 on 07/16/06 07:18

I agree with the suggestion to keep username/password files outside the
web root. If you cannot do this (such as scripts like PHPBB and
Coppermine) place the username/passwords inside a PHP file as varibles
which can be included in any needed scripts, this way, if someone knows
the name of the password file, and tries to view it, all they will see
is a blank screen, as the PHP was parsed and dealt with before being
sent out.

[Back to original message]