config.php 在根黑客安全中，权限设置为 644？
即使将权限设置为 644，将 config.php 放在网站的根目录中是否安全？
I it safe to place config.php in the root of your website even though it has premissions set to 644?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
你的 config.php 应该可以被你的网络服务器读取，并且任何权限的修改都不会改变这一点。
另外，将它放在其他地方也没有多大帮助 - 因为既然你的 php 代码应该能够读取它，任何设法在你的服务器上运行他的代码的黑客都将能够读取它。
因此，无论您将其放在哪里，它都面临着被成功入侵您的服务器的黑客访问的危险。将其放在网络根目录中并不比将其放在其他地方更安全或更不安全。
your config.php should be readable by your web serevr, and no fiddling with permissions will change that.
also, putting it anywhere else will not help much - because since your php code should be able to read it, any hacker that manage to run his code on your server will be able to read it.
so, no matter where you put it, it's in danger of being accessed by a hacker that managed to hack your server. putting it in the web root is not more or less secure than putting it anywhere else.
只要没有人可以通过 SSH 或 FTP 访问您的服务器，并且您的网站中不存在允许任何人访问 PHP 文件源的错误/安全漏洞，那么这应该是没问题的。
请注意，您的 Apache 用户必须访问该文件（以便可以从其他 PHP 脚本中包含该文件）；因此，无论你把它放在哪里，如果你有一个允许用户读取 PHP 文件的安全漏洞，它不会改变任何事情。
一个想法可能是将该文件放在文档根目录之外，或者放在受 .htaccess 文件保护的目录内，拒绝任何人的访问 - 至少，如果您的服务器配置不正确并显示源代码PHP 文件，该文件的内容将不会显示（因为无法通过 HTTP 直接访问/提供服务）。
如果安全漏洞允许 PHP 文件显示其他 PHP 文件的内容，这将无济于事（我已经看到过这种情况发生），但这仍然是第一步。
As long as no-one has an SSH or FTP access to your server, and that there is no bug / security hole in your website that would allow anyone to access the sources of the PHP files, this should be quite OK.
Note that your Apache user has to access that file (so it can be included from other PHP scripts) ; so, wherever you put it, if you have a security hole that allows PHP files to be read by users, it won't change a thing.
An idea might be to put that file outside of the document root, or inside a directory protected by an .htaccess file denying access from anyone -- at least, this way, if your server is not well-configured and displays source-code of PHP files, the content of that file would not be displayed (as it could not be access/served directly via HTTP).
This will not help in the case of a security hole that allows PHP file to display the content of other PHP files (I've seen that happen), but that would still be a first step.