Important Notice: Our web hosting provider recently started charging us for additional visits, which was unexpected. In response, we're seeking donations. Depending on the situation, we may explore different monetization options for our Community and Expert Contributors. It's crucial to provide more returns for their expertise and offer more Expert Validated Answers or AI Validated Answers. Learn more about our hosting issue here.

Why should web uploads be stored outside of the document root?

April 26, 2017DOCUMENT outside stored uploads web

0

10 Posted

Why should web uploads be stored outside of the document root?

1 Answer

0

10 Posted

The intent of this stipulation is to prevent someone from directly accessing content that they may have just uploaded. If someone uploads a PHP script to your web server, and your server is configured to store uploads within the main web site directory structure, and your server is configured to execute PHP scripts from within the main web site directory or sub-directories, then the uploader could directly request the URL to the uploaded file and have your server execute their script.