Writeable Folder Security

[Bob Crabb]

Although some scripts require certain folders to have permissions set to 777 (for picture uploads, etc), this has always made me feel uneasy. I suppose that part of that uneasiness comes from an experience about a year and a half ago of finding some unwanted "gifts" deposited on my site, an incident that fortunately I caught before any damage was done.

 

Anyway, I read on another forum that a good way to secure writeable folders would be to disable php in that folder by including the following code in the .htaccess file for the folder:

 

>php_flag engine off 
<Files ~ "\.(php*|s?p?html|cgi|pl)$"> 
deny from all 
</Files>

 

That seems to make sense, but I wanted to ask for opinions on the advisability of doing this.

[TCH-Andy]

It will improve the security blocking access to these files