Geek Answers Handbook

PHP file protection

Hi and thanks to everyone for reading my question.

I worked on the PHP web program for some time and wondered what measures should be taken to protect the source before putting it on a live server. The source is not distributed, it is accessed through the website (users register on the website to use it).

First, I would like to protect the php source files from searching and loading. I do not use the framework, only php and all the files are in the home directory as index.php. I read and it seems that robots.txt is not very effective for hiding. I came across some reports about .htaccess recommendations, but I often thought it was protecting files in a directory with a password, so I'm not sure if there is a way to make it htaccess suitable for a web application.

Secondly, I would like to protect the source files if someone gets access to them (either finds them, or loads them, or the sys administrator, who has ready access to the server). I was thinking about encrypting the source with something like ioncube. My host also has GnuPG (which I am not familiar with, any thoughts on this compared to ioncube?]

I am not familiar with source protection, so any ideas would be nice and, of course, thank you very much :)

+3
source share
3 answers

Just make sure your web server is configured to handle files correctly .phpand that all files have the correct extension .php(not .php.incor similar)

While your server is running PHP, no one can load its source code (ignoring any holes in your code, which is another topic)

, , mystuff.php.inc - . , "example.com", config.php.inc - - URL-, http://example.com/config.php.inc .

bisko answer - , ..

/var/example.com:
    include/
        config.php
        helper_blah.php
    webroot/
        index.php
        view.php

, - .php , , ..

, , . Apache ( , ) . Apache , ..

, .

+3

, -, serverfault. / -.

, obfuscator, , , , . , , .

0

The first step that you must take is to take out all the unnecessary files from the root of the website and put them in a different place and leave only files called from the Internet.

For example, if you have this setting:

 /var/htdocs/mysexydomain.com/root/config.php
 /var/htdocs/mysexydomain.com/root/db.class.php
 /var/htdocs/mysexydomain.com/root/index.php
 /var/htdocs/mysexydomain.com/root/samplepage1.php

Take all the files one level higher to get

 /var/htdocs/mysexydomain.com/includes/config.php
 /var/htdocs/mysexydomain.com/includes/db.class.php #see the includes dir? :)
 /var/htdocs/mysexydomain.com/root/index.php
 /var/htdocs/mysexydomain.com/root/samplepage1.php
0
source

More articles:


All Articles