PHP Script Security Risk

[SandraJose]

Hi

Actually I am planning to create an application that stores stuff in the similar folder where the PHP script runs from. I think this will cause some security problems, but then I wan to know is there any way to do this if it's necessary.

[paullopez]

I think this could be a security risk, however, you can increase security in this case and storing stuff in a public folder is not always an issue. What you need to do is, securely protect the upload script so only authorized user can upload it. You should also set the correct permissions on the directory and make sure only files types you are expecting are uploaded. One more thing you can do to reduce security issue. You can restrict IP address or .htaccess files to ensure someone is logged on before downloading a file. There are too many ways, but it really depends on what you are trying to do with your system. However, do this if you absolutely need to do this, IMHO creating sub-directory in the script location is the only writable area to your web users.