For security most PHP files are out of the document root, but some are now not accessible

Question

I am developing a internal website and it has no domain (DNS not configured for domain name) so it is just accessed via internal IP address.

I have read that it is a good idea to keep backend files such as php files that connect with the database out of the documentroot and put it one level above. My structure is currently something like this:

/Website Main Directory
    /Backend (contains header.php, footer.php, login.php, logout.php)
    /Public (index.php, *.css, *.js, *.images)

Apache Virtual host directory points to this Public folder.

My index.php has include header.php and footer.php which works good and all the files in the public folder works as supposed to.

In my header I have a login form which calls login.php but the problem is login.php is located in the backend. Html can't do what php does which read's the backend files, so it will just throw me a 404. How can I make the html access the login.php in backend folder which is out of the documentroot folder.

Update:

I have tried to include the whole backend folder path but it still says login.php was not found when I submit my form:

    <header>
        <div class="headerblackbar">

            <?php 
                    session_start();
                    include '/var/www/html/.../.../login.php';
                if (isset($_SESSION['loggeduser'])) {
            ?>

            <div class="Loggedin">
                    <div class="uname">
                        <?php echo $_SESSION['loggeduser']; ?>
                    </div>

                    <form action="logout.php" method="post">
                        <div class="logoutbtn">
                            <button class="logoutbtnc" name="logout-submit" type="submit" id="logout-submit">Logout</button>
                        </div>
                    </form>
            </div>

            <?php
                } else {
            ?>

            <div class="loginform">
                <form action="login.php" method="post">
                    <div class="uname">
                        <input placeholder="Username" name="username" id="username" type="text" style="float: left;" required>
                    </div>

                    <div class="pwd">
                        <input placeholder="Password" name="password" id="password" type="password" style="float: right;" required>
                    </div>

                    <div class="loginbtn">
                        <button class="loginbtnc" name="login-submit" type="submit" id="login-submit">Login</button>
                    </div>

                </form>

            </div>

            <?php
                }
            ?>

        </div>

    </header>

Answer 1

Do not submit form to login.php file which does not exist in Public directory.

Post data to index.php?action=login and in index.php try including login.php for this very action. This could be done with

switch ($_GET["action"]) {
    case "login":
        include "../login.php";
        break;
    case "anotheraction":
        include "../otherfile.php";
        break;
}

Using method like this you can define multiple actions and include different files.

If you like to do it in more professional manner, then:

• Use mod_rewrite to redirect all requests to index.php
• Use so called routing in PHP
• Start using some framework or microframework. Most of dirty job is done by someone else so you can focus on actual coding. Most of framework also promotes good practices in documentation so you can create better code.\