3

Is it normal to users can see www.yourwebsite/php/config.php files ?In my site I can reach thoose files as a text file.And I can see which user name or table or some information about my Mysql connection.All of my files in my Xammp htdocs folder.Are they will be also visible when I add them to some host?

19
  • 4
    No, this is not normal: Your web server must be misconfigured. Voting to migrate to serverfault.com
    – Pekka
    Aug 28, 2010 at 11:07
  • I am using my computer as a server.And it shows my files.
    – Meko
    Aug 28, 2010 at 11:10
  • 5
    @Col. Shrapnel: If anyone can access his config files over http, possibly containing database passwords and such, as plain text, then it is no-longer premature.
    – Douglas
    Aug 28, 2010 at 11:14
  • 1
    @Col. Shrapnel: And neither does Douglas, the OP wrote "I can see which user name or table or some information about my Mysql connection" and this shouldn't be! So something is definitively going wrong
    – jigfox
    Aug 28, 2010 at 11:20
  • 4
    Let's play "Guess who's grumpy" ;-)
    – VolkerK
    Aug 28, 2010 at 11:35

5 Answers 5

4

Try not putting your config files in a public directory. If the content on your web server is in here:

/usr/meko/htdocs/php/index.php

you could move the config file out of the public htdocs folder and put it here:

/usr/meko/config/config.php

Alternatively, (and not as good), you can make sure that your config files are treated as php files, then start them with the php open tag:

<?php

$CONFIG["foo"] = "bar";
// config here, which never echoes anything

When someone accesses the php file over http through your web server, they will only see blank output.

2

It sounds like apache is not configured to execute your php files and is instead serving them as test/html.

You need to set up a handler to execute php files as php.

Under linux the syntax would be something like the following. Under windows the path "modules/libphp5.so" will need to be modified to point to the php module, which might be a dll.

LoadModule php5_module modules/libphp5.so AddHandler php5-script php AddType text/html php

See http://php.net/manual/en/install.windows.apache2.php and http://httpd.apache.org/docs/ for details.

1

Yes. it is quite normal.
No, you can't reach those files as a text file using this address (assuming your site is functioning)

0
1

Is it normal to users can see www.yourwebsite/php/config.php files?

Yes if they are in the htdocs folder, except you deny access to the folder containing the config.php via a .htaccess-file or via the apache config. Or you move such files out of the htdocs folder.

In my site I can reach thoose files as a text file. And I can see which user name or table or some information about my Mysql connection. All of my files in my Xammp htdocs folder.

This shouldn't happen, this seems to be a configuration Problem. It seems PHP is not working correct.

Are they will be also visible when I add them to some host?

Yes they will be visible, but you shouldn't be able to see the php contents, if the server is configured correctly, because you shouldn't be able to see any php code in your browser, if you do there is something wrong. To make sure upload a test file to your hoster and see if you can see the php code in these files.

1

As an exmaple, any wordpress installation has it's config file in the root dir. But as it don't echoes the vars there is no security issue, as long as the files are treated as PHP scripts and not text files. But it is a good idea to block direct URL access to such files through a .htaccess file password protection.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .