Code Organization

Some would argue that any file not directly accessible to the user from the Internet should not find a place in the document root of the web site. For example, if the document root for our message board web site is /home/httpd/messageboard/www, we should place all of our .inc files and other files in a place such as /home/httpd/messageboard/code. When we want to include those files, we can simply write in our code:

require_once('../code/user_object.inc');

The reasons for this degree of caution come down to what happens when a malicious user makes a request for a file that is not a .php or .html file. Many web servers default to dumping the contents of that file to the output stream. Thus, if we were to keep user_object.inc in the public document root and the user requested it, he might see a full dump of our code in his web browser. This would let him see the implementation, get at any intellectual property we might have in this file, and potentially find exploits that we might have missed.

To fix this, we should be sure that the web server is configured to only allow the request of .php and .html files , and that requests for other types of files should return an error from the server.

Similarly, files such as password files, text files, configuration files, or special directories are best kept away from the public document root. Even if we think we have our web server configured properly, we might have missed something. Or if our web application is moved to a new server that is not properly configured in the future, we might be exposed to exploitation.

The Advantages of Dynamic Website Content

Think about your own surfing behavior. What types of websites do you visit the most often; which ones keep drawing you back?

If you are like most internet surfers, you will spend much of your time hanging around websites with dynamic website content, or content that is updated constantly or personalized to your preferences. The age of static, archival websites is long gone, in in its place is a dynamic and powerful internet driven by PHP, ASP, CGI, and Java.

But setting up a website with full SQL support and advanced features is not an easy task, especially for someone who is still waist deep in HTML coding.

So...what to do?

If you don't have the time or the will to commit to an advanced website with cutting-edge features and complicated scripts, there are still a good number of options that will make your website look more professional, with minimal effort.

An excellent resource is Hotscripts - you can find a huge number of complete server side scripts there, many of them free. Another great resource is this Random Text Generator, which is a powerful PHP script to generate random content on your website. Show a new quote every day!

In the end, the choice to go all-out is up to you, but with the help of a few handy scripts and some rudimentary server-side know-how, you can turn a static page into an impressive multi-faceted datacenter overnight!