Posted by Geoff Muldoon on 07/13/05 04:15

Phil Coen says...

> Most use an HTML form that calls a separate php program. Most of the
> passwords are either hard coded in that php module or are in a file
> accessable by that module.
>
> Heck, anybody can download the php script and look at the passwords. Or,
> use it to see what file it is pointing to.

Phil,

The PHP include() function, unlike the HTML include, can reference files
which are outside the Apache docroot.

If you *have* to hard-code passwords somewhere, at least put them in a
file outside the Apache docroot and use a PHP include() call to reference
them in any PHP scripts which are within the scope of the Apache docroot.

Geoff M

[Back to original message]