Access to files outside of the public folder

Question

For security reasons I want to have all my connection files to the DB and login files in a folder out of the root directory. Like this:

Project:
       includes:
            conncect.php
            process_login.php
       general_files:
            index.php

In my index.php i have the following.

<form action="../includes/process_login.php" method="post" name="login_form">
      [...]
</form>

The problem is that when i try to submit that form i get an error that says that:

 The requested URL /includes/process_login.php was not found on this server.

Does anyone knows a way to do what i want to do?

You can't traverse outside the document root with an HTTP request. You can via `include()` and other file operations. — Scott Arciszewski, May 18 '16 at 17:12

score 3 · Answer 1 · edited May 23 '17 at 12:13

3

As seen here: "to be safe, you should move the include files outside document root, thus making it impossible for the web server to serve them directly." However, to access them, you can use a full path, like so:

include('/home/xx/xx/domains/mydomain/webroot/file-to-include.php');

As seen here.

edited May 23 '17 at 12:13

Community

1
1

answered May 18 '16 at 17:04

DubleHoody

31
3

score 2 · Answer 2 · answered Oct 03 '16 at 19:03

It appears that your document root is <Project>/general_files, and if that's the case, then your process_login.php file is outside of the public web folder.

You have two options:

1) Move process_login.php to the general_files/ directory and update the action attribute accordingly:

Project:
   includes:
        conncect.php
   general_files:
        index.php
        process_login.php

2) Or add a new PHP file (e.g., new_login.php) to general_files/ that includes process_login.php, and set your form's action attribute to this file:

Project:
   includes:
        conncect.php
        process_login.php
   general_files:
        index.php
        new_login.php

Access to files outside of the public folder

2 Answers2