Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it normal to users can see www.yourwebsite/php/config.php files ?In my site I can reach thoose files as a text file.And I can see which user name or table or some information about my Mysql connection.All of my files in my Xammp htdocs folder.Are they will be also visible when I add them to some host?

share|improve this question

migrated from stackoverflow.com Aug 28 '10 at 13:26

This question came from our site for professional and enthusiast programmers.

4  
No, this is not normal: Your web server must be misconfigured. Voting to migrate to serverfault.com –  Pekka 웃 Aug 28 '10 at 11:07
    
I am using my computer as a server.And it shows my files. –  Meko Aug 28 '10 at 11:10
5  
@Col. Shrapnel: If anyone can access his config files over http, possibly containing database passwords and such, as plain text, then it is no-longer premature. –  Douglas Aug 28 '10 at 11:14
1  
@Col. Shrapnel: And neither does Douglas, the OP wrote "I can see which user name or table or some information about my Mysql connection" and this shouldn't be! So something is definitively going wrong –  jigfox Aug 28 '10 at 11:20
4  
Let's play "Guess who's grumpy" ;-) –  VolkerK Aug 28 '10 at 11:35
show 14 more comments

5 Answers

Try not putting your config files in a public directory. If the content on your web server is in here:

/usr/meko/htdocs/php/index.php

you could move the config file out of the public htdocs folder and put it here:

/usr/meko/config/config.php

Alternatively, (and not as good), you can make sure that your config files are treated as php files, then start them with the php open tag:

<?php

$CONFIG["foo"] = "bar";
// config here, which never echoes anything

When someone accesses the php file over http through your web server, they will only see blank output.

share|improve this answer
add comment

Yes. it is quite normal.
No, you can't reach those files as a text file using this address (assuming your site is functioning)

share|improve this answer
add comment

It sounds like apache is not configured to execute your php files and is instead serving them as test/html.

You need to set up a handler to execute php files as php.

Under linux the syntax would be something like the following. Under windows the path "modules/libphp5.so" will need to be modified to point to the php module, which might be a dll.

LoadModule php5_module modules/libphp5.so AddHandler php5-script php AddType text/html php

See http://php.net/manual/en/install.windows.apache2.php and http://httpd.apache.org/docs/ for details.

share|improve this answer
add comment

Is it normal to users can see www.yourwebsite/php/config.php files?

Yes if they are in the htdocs folder, except you deny access to the folder containing the config.php via a .htaccess-file or via the apache config. Or you move such files out of the htdocs folder.

In my site I can reach thoose files as a text file. And I can see which user name or table or some information about my Mysql connection. All of my files in my Xammp htdocs folder.

This shouldn't happen, this seems to be a configuration Problem. It seems PHP is not working correct.

Are they will be also visible when I add them to some host?

Yes they will be visible, but you shouldn't be able to see the php contents, if the server is configured correctly, because you shouldn't be able to see any php code in your browser, if you do there is something wrong. To make sure upload a test file to your hoster and see if you can see the php code in these files.

share|improve this answer
add comment

As an exmaple, any wordpress installation has it's config file in the root dir. But as it don't echoes the vars there is no security issue, as long as the files are treated as PHP scripts and not text files. But it is a good idea to block direct URL access to such files through a .htaccess file password protection.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.