Ok, so I know this must be a very basic question, but my problem is the following: I have developed my first PHP mini-app (so I'm fairly new to this) and I am pretty sure that there are two files of my web application that should be somehow protected from prying eyes
- the one with the details to connect to the db
- the one with the password hashing and the salt key
How should I go about protecting them? I have read somewhere that they should be put somewhere above my public directory, but then how will the app be able to access them? Should I change something in my apache config so that the Document Root is different than something else?
Any other things I should consider in terms of security? So far I am escaping every user field that goes into the db with mysql_real_escape_string(), but apart from that and hashing and salting the passwords, I'm not doing anything else.