PHP php.ini file in the web public root directory ? is it safe enough

Question

I heard when you want to change the php.ini settings when you don't have access to the php.ini in the root level that you can upload a php.ini to the web-root, is this correct ?

Another way to customize your PHP settings is to create a file named php.ini and to upload it to your web server. This works in a way similar to the .htaccess file except you don’t have to add “php_value” at the beginning of the line

if this correct that means anyone who type

www.xx.com/php.ini 

should see the settings ? isnt this a security risk ?

Answer 1

It's safe from people editing it. However it is visible to anyone who stumbles across your php.ini, so it's better to use .htaccess to disallow people from seeing it so readily.

Answer 2

I'd stick to using ini_set instead of putting a php.ini file up there.

But if you had to, you had better secure it with the right set of .htaccess rules. Something like

<Files php.ini>
Order allow,deny
Deny from all
</Files>

The above rule will prevent anyone accessing that file as www.xx.com/php.ini