Best file location for include files

Flip69 · 06-13-2007, 09:23 AM

We are developing in php on our linux server and want to put the include files outside the var/www/html structure for security reasons, what is the best location to put these files ?

Is this more secure ?

Is /usr/include a good location ?

Or /usr/src ?

nautilus · 06-13-2007, 10:21 AM

It doesn't really matter where you have your include files, as long as the directory and files have the right permissions (right permissions = the minimum permissions needed for the application to be able to read them only and nobody else to access them).

If you want a suggestion, I would put it in /usr/local/include/

(the /local/ usually means that what follows is not part of the system, but to the local application(s)/service(s))

Or create something more tailor made like:

/usr/local/<your company's name>/include

Stick more to the permissions than the path...

Wim Sturkenboom · 06-13-2007, 10:26 AM

My tree looks something like

Code:

www
 |
 +-- site1
       |
       +-- web
       |
       +-- include

Web is the document root for a site. In your situation, I would put it next to the html directory. For me, it gives the advantage that the include files 'stay' with the corresponding site (in case you host multiple sites like I do).

PS
It's more secure as a browser can not access pages that are not under the document
root.