placing php script outside website root

Question

how would i a)include a php script that is outside the web root (would it really be just a simple ../file.php), b)post form data to a php script outside the web root. I'm led to believe this is a corner stone to php security.

Answer 1

including a script that's outside the webroot is easy : you'll do the same way as you're doing for a script that's under the webroot :

include '../myscript.php';
include '../library/myscript.php';
include dirname(__FILE__) . '/../library/myscript.php';

The one you prefer ;-)
I would go for the last one, personnaly, though.

Posting to a script that's outside the webroot is not possible : that script cannot be served by Apache (Apache only serves what's inside the web-root).

So, that script cannot be accessed via HTTP ; which means it cannot be accessed from/by the browser.

But if you are posting to a PHP script that's inside the webroot, and that script includes another one that is outside the webroot, then the code in that second file will be executed as the first script. Which means it'll have access to the $_POST data -- the data typed in the form.

Answer 2

A) if your web root is /www/myapp/public_html then your public_html/index.php could include scripts outside the web root by doing

require '../includefolder/script.php"

B) You can't post data directly to scripts outside the web root. The whole point of moving them there is so that there is no direct access to them; everything must pass along to them from your accessible scripts which are exposed in your web root.