setting up website for logged in users, anyone, and files no one should see (via the web) [closed]

Question

I asked how to prevent not logged in users from seeing certain content but the solution I chose to implement encountered a problem. I chose to make my root directory for the server C:\WAMP\www\public and to include the files I only want logged in users to see from C:\WAMP\www\private. The problem is if I have a script that needs to be interpreted by the server (such as .php) that I don't want the public but if I put them in private the server won't run them and if I put them in public then anyone can access them. Should I abandon this approach with private and public and use .htaccess instead? In the second link a suggestion was to make a file in the public directory that includes the script in the private directory but I think that's getting too messy. Any better solutions?

Come to think of it there really is three levels of security

1. Content anyone can see (e.g. the registration page)
2. Content only logged in users can see (e.g. the members only section)
3. Content no one can see (e.g. scripts that add user accounts or make calls to the database - hold on is this even a security breach if anyone can see these sorts of things?)

Answer 1

It seems like there might be some weird things or misunderstandings going on here. A web server will only present files to a user that it is instructed to provide. By default, on many web servers, this is any content that it does not have a means of processing directly, thus any files in the web folder end up being publicly visible. However, in the case of a properly configured server side script file such as PHP, the server should instead pass the file to a handler (PHP) to be interpreted and then provides the output of that script to the client requesting the "file".

In general, your script handlers will run as a separate user from the web server. The scripting engine needs to have access to whatever files it needs to be able to execute on and the web server simply needs to be able to call the scripting engine. In this way, you can have script files which PHP can get to that the web server does not have access to. Additionally, this should allow you to have PHP files interpreted wherever the URL that points to them may be. You simply have to ensure that the binding to the scripting engine is properly configured.

As for the specifics of configuring on your particular server, Webmasters might be of more assistance since they have a wider set of experience with particular web server applications and script handlers aren't really directly a security concern.