I installed Ubuntu 14.04 and Apache.

It seems I should place my web site files in the "/var/www/html" directory.

But then where should I place my backend PHP files?

For example, if I have web site forms that will on submit make a request to a backend PHP file, should I put the PHP file in "/var/www/php" and have, for example, the "/var/www/html/index.html" file form action refer to "../test.php"?

I don't want people in general to have access in the browser to my PHP files, which is why I feel they should be above "/var/www/html", but if that is the web root, how can "../test.php" work?

2 Answers 2


Generally PHP files are meant to be accessed by the general public. For example, index.php resides in /var/www/html and handles all requests for "/". If your app file is test.php, then try placing it in /var/www/html/test.php and you can browse to it directly.

As long as you have mod-php5 loaded and enabled, apache will execute that script instead of returning the source code.

  • I guess what I mean is, what if my PHP files will have database information, such as tables, columns, maybe even MySQL user and password info. I want my forms to be able to access those php files, but I don't want the general public to view the contents of those php files. Oct 28, 2015 at 2:11
  • 2
    As long as you have mod-php5 enabled, the general public will not be able to view the contents of those files. sudo a2enmod php5 sudo service apache2 restart
    – cdp1337
    Oct 28, 2015 at 2:12
  • Okay. But what if people try to execute my php scripts directly, passing in parameters to fool the script into doing something nefarious? Oct 28, 2015 at 2:15
  • 1
    :) That's where proper POST sanitation comes into play! You need to be very cautious about accepting user input, (in specific, never trust user-provided data!!!) For example if you have a form element for email, ensure that only valid characters are submitted to that form. If you detect form tampering, then redirect back to the original form html, optionally with an error back to the user. Many practices are common to inject a one-time form ID into the original form, and require that hash to be present in the submitted data, otherwise they didn't come from your form!
    – cdp1337
    Oct 28, 2015 at 2:29
  • 1
    Another thing, check $_SERVER['HTTP_REFERER'] for your form.html. If it's not present, then the user may be trying to do something nefarious. By having them in a subdirectory, the user can still execute them directly by browsing to site.tld/php/form.php.
    – cdp1337
    Oct 28, 2015 at 2:29

I put my PHP files in /usr/share/PROJECT-1.0.1 and symlink /usr/share/PROJECT -> PROJECT-1.0.1. Then I create an Apache config file /etc/apache/sites-available/PROJECT

Alias /project /usr/share/PROJECT/test.php

<Directory /usr/share/PROJECT>
    DirectoryIndex test.php
    Options FollowSymLinks -Indexes
    Order deny,allow
    Deny from all
    <Files test.php>
        Allow from all

And add Include sites-available/PROJECT to /etc/apache/sites-available/default

This way I can add new a version 1.0.2 in /usr/share/ and when I'm done I just switch the symlink /usr/share/PROJECT -> PROJECT-1.0.2

Also nobody can access any files inside that folder except test.php

  • That's interesting. As I might have many html files with forms that might need to access my various php scripts, I'll have to figure out how to extrapolate your example to that scenario. But thanks, that helps a lot. Oct 28, 2015 at 2:30
  • Just keep in mind that your test.php will be available as http://YOURHOST/project with that Alias
    – Germar
    Oct 28, 2015 at 2:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .