security - placing php script outside website root

Question

how would i a)include a php script that is outside the web root (would it really be just a simple ../file.php), b)post form data to a php script outside the web root. I'm led to believe this is a corner stone to php security.

Answer 1

including a script that's outside the webroot is easy : you'll do the same way as you're doing for a script that's under the webroot :

include '../myscript.php';
include '../library/myscript.php';
include dirname(__FILE__) . '/../library/myscript.php';

The one you prefer ;-)
I would go for the last one, personnaly, though.

Posting to a script that's outside the webroot is not possible : that script cannot be served by Apache (Apache only serves what's inside the web-root).

So, that script cannot be accessed via HTTP ; which means it cannot be accessed from/by the browser.

But if you are posting to a PHP script that's inside the webroot, and that script includes another one that is outside the webroot, then the code in that second file will be executed as the first script. Which means it'll have access to the $_POST data -- the data typed in the form.