permissions on flat file php authentication

blizunt7 · 11-21-2005, 08:06 PM

Hey all,
I am trying to create a secure site. Have decided to go with PHP, working fine. I am using a flat file to authenticate users, and have run into an issue. With the permissions set for all to read, one can view the file from the browers if the flat file name is know.
However, with read permissions removed, any user cannot access this file and authentication can not take place. Am i missing something here?

THanks.

Josh

spooon · 11-23-2005, 05:39 AM

You should put the file in a directory that is not under the Web site, since PHP can read from other locations in the system. You can also set Apache to deny access to that file.

theYinYeti · 11-23-2005, 06:13 AM

Else the simple solution I use for my own framework is to give the file the PHP extension, and write it like that:

Code:

<?php exit(1); ?>
...
... Actual content of the file
...

Yves.