4 ms·
The fundamental problem with many PHP applications is that the php files are located in document root, i.e. can be potentially served as static files. More corr
by Yaggo 14y ago
The fundamental problem with many PHP applications is that the php files are located in document root, i.e. can be potentially served as static files. More correct approach would be to put them outside document root (e.g. APP_DIR/lib), and using index.php which requires them (e.g. APP_DIR/static/index.php).
- mylittlepony 14y agoThat's not restricted to PHP, since it does not even depend on the language.
- Yaggo 14y agoTrue, but other languages are not typically processed in the traditional mod_php way where urls are directly mapped to files in your static root, thus it's extremely rare to see e.g. python or ruby files served as static files.
- mylittlepony 14y agoI don't know what you mean. You just tell the web server what you want to do, and it will do it. Eg: "Process only files in this dir, and only accept requests to this kind of URL. And any request to that kind URL, pass it to this single php file". Do software like XAMP have bad defaults and shouldn't be used for production out of the box? Maybe. Has that helped a lot of people to get started, and make PHP the most popular server language for the web? Definitely. Should we mock all php devs including experts, because of designers or ninja CEOs who tried/succeeded in editiing or making a website but made some mistakes in the process? The answer is still no.
- bradleyland 14y agoI'm not sure this is fair to pin on PHP in a broad way. Many PHP frameworks do not use the application file-structure root as the httpd document root. For example with a Symfony app: . - App root ./web/ - httpd doc root ./app/ - app files ./app/config/ - config files Barring an exploit that lets you break out of the httpd doc root (not saying this is impossible), there is no way to request the config or app files directly.