CODEWITHSUNDEEP
phphtmlapachewebserver
Cainã
Cainã

Reputation: 955

How to secure PHP files from being downloaded?

I have a doubt about PHP, Apache, server interpretation... I know that when a PHP file is loaded by the browser from an Apache+PHP server it is interpreted and only the HTML and plain text is showed but is there a way to download this files instead of interpreting them? In this case it would be very unsecure because MySQL passwords would be unsafe.

Is it any security measure to prevent this or it's impossible to download this files?

Upvotes: 0

Views: 4564

Answers (5)

Omnikrys
Omnikrys

Reputation: 2558

As long as your server is setup properly it isn't going to happen.

A good step though is to put all of your actual passwords and whatnot in a config.php and including it. That way you can use htacces too block that file so that should your server ever start serving the raw pages that file won't be accessible anyway.

To clarify if you create a .htaccess file and place it in the same folder as the config.php with the below information that file will not be served, even if requested directly. Simply define your config stuff (db name, user name, password, hashes, etc) in this file and include_once it at the top of each page that needs it and you will be good to go.

<files config.php>
    order allow,deny
    deny from all
</files>

Upvotes: 7

ICoffeeConsumer
ICoffeeConsumer

Reputation: 912

Unless the PHP interpreter stops working for some reason, it's not something to worry about. Most servers are designed to interpret the PHP files every time they are requested and serve only the interpreted HTML text. It's possible to secure your sensitive PHP settings files just in case - often by placing them outside of the root directory with modified permissions.

Upvotes: 1

Filkor
Filkor

Reputation: 642

There is no way to 'download' PHP files, but for more security you can place your 'core' PHP files outsite of the public_html folder

Upvotes: 1

Vyktor
Vyktor

Reputation: 21007

With proper configuration apache guarantees that files will always get interpreted and won't be offered for download.

You always may install fault update or make wrong configuration, but with skilled admin and stable release those cases just don't happen.

Upvotes: 0

Chuck
Chuck

Reputation: 237110

The only way someone could download the files is to have a server set up that serves the raw files. As long as you don't have such a server set up, they're inaccessible. If the only server software on your system is Apache and it's configured correctly, people cannot see your source code.

However, if somebody seeing your source would render your app vulnerable, you might want to give some thought as to how you can fix that problem. Lots of secure open-source software exists — why would yours being open-source cause problems?

Upvotes: 0

Related Questions