I continually hear and read people warning against the perils of placing proprietary information or confidential documents within the web server root directory. If I am on a shared server, I cannot place files "above" the root in the document tree. Is there a work around for this that is not too hackish?
More specifically, I would like to put configuration information into an ini file. What can I do that so people cannot download it (let alone modify it)? Where should I put it to minimize the risk of misconfiguration or bug exploitation?