We just removed some repeated code by extracting it out into three separate files one for the database
connection code one for the start of the astm Owl and one for the end.
Right now these files are all in the root folder of our site.
So let's start arguing using our code a bit better by putting these files in their own folder.
It's common to put included files in a folder called includes.
So that's what we'll call it.
Then we can simply move the files including into this folder.
Like that.
Next we need to change our required statements to include this new folder here for the database.
Include here for the header include.
And down here for the footer in articles up here.
P will do the same thing here at the top and the same for the header.
And the footer.
In a browser nothing has changed and it works just as before.
Now that we've got these files in a separate folder we can add some security to our site.
These files just like files in the route are accessible in a web browser.
If I try to go to includes slashed databased up P 8 p.
I get an empty page.
This is because the file contains nothing but P HP and therefore this is executed before it's sent to
the browser.
However it's possible that a server misconfiguration could stop HP from working if this happened.
The cold would be sent to the browser.
Let me show you what I mean.
I've just gone and replicated a problem with the server which could result from someone not managing
the server properly and I've turned HP off.
Now this is an unlikely scenario but it doesn't hurt to be aware of it and protect yourself against
it.
You can if I try and access the database file again.
Instead of a blank page the browser downloads it.
And when I open it we can see the entire contents of the script including our database password.
To fix this we can deny access to this directory as we using the Apache Web Server.
We can create a special file called an 8 access file which allows us to configure the web server on
a per directory basis.
So let's create an H to access file in the includes folder and it has to be called exactly that dot
h.t. Access and then in here will enter the configuration setting.
Denied from all which basically says denied access to files in this folder from any computer.
Now if we try and access the database file in a browser we get an access forbidden message.
This is an optional step but it doesn't hurt to have a little bit of extra security just in case.
And this doesn't affect our website.
It works as before.
This solution is based on the Apache Web server which is what you are using.
If you installed X amp but if you're using a different web server and want to know how to do this please
let me know.