I have a PHP script that takes some sensitive data, hashes it, and then compares it against hashes in a text file on the server. Both the text file containing hashes and the PHP script are located in the same folder.

The problem is that I want only the PHP file to be able to read that text file -- not everyone on the web. However, I tried: chmod 444 filename.txt and that of course, gave everyone 'read' permissions on it -- even people on the web. Now anyone on the web can directly call that text file over my server. I tried '440' but that restricted access for the PHP file as well.

How can I make the text file readable to the local PHP script, but restrict access to it for 'everyone' on the web?

  • Wouldn't such data be better stored in a database? – Wildcard Mar 15 '16 at 1:01
  • It is a quick page I coded for some students in my class on a department web server. For now, I'm going with the text file. – learnerX Mar 15 '16 at 1:04
  • In that case, what about using group permissions? – Wildcard Mar 15 '16 at 1:23
  • That's what I was thinking as well. But didn't know where to begin. Could you be more explicit regarding how I might set group permissions? – learnerX Mar 15 '16 at 1:27
  • 1
    I think this depends on the webserver. Maybe you can use a .htaccess-file. Sometimes PHP is executed by another user as the webserver which reads the files. In this case, you could use group permissions. But then you have to know which groups are used. – JojOatXGME Mar 15 '16 at 1:32

A common solution is to use a .htaccess file that allows access only for the local host. Try this:

Order Allow,Deny
Allow from

And save that file in the directory. You can then try to access that direction from a web browser to verify if this solution worked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.