PHP & cron: security issues

Question

Whats the best way to ensure that only CRON executes PHP scripts, and not someone else who stumbled upon your php scripts..

I was thinking a Password Variable.... but is this a legal CRON command? :

/usr/local/bin/php -f /home/mysite/public_html/dir/script?password=12345

This way people cannot be able to execute the same commands when visiting the PHP script via HTTP (unless they know the password)

Thanks.

Answer 1

You should keep this file outside of public_html

/usr/local/bin/php -f /home/mysite/script 
// is secure from public access

Answer 2

Suppose if u don't want anybody to run the file via http then set the cron by using php command as you are doing and add htacess to cron folder to block http request to the folder by adding

deny from all to htacess

Suppose if u want the cron folder to be password protected then it can be done as mentioned in the URl

http://www.elated.com/articles/password-protecting-your-pages-with-htaccess/