Just add that piece of code to the top of config.php in the admin folder, if anyone tries to access the config.php file that wasn't called within the users document root the script simply exits.

at PPN's advice, i decided to keep the adduser.php file private. only admins will be able to have a copy.

why you don't see the point? can you explain more please?

I need to go play in the snow now :D

The code i posted above works on my test board.

If the user has access on the shared server, then they probably have shell access so they can just navigate into your folders open config.php using pico or vi and read the values right off it and then simply access it via phpmyadmin in their own folder.

lol.. ok.. here few snow balls thrown at you..
@ @ @ @ @... ;)

si in other words, there is no way to call a path from outside the server and do a mysql_connect?

The hacker would have to be on the same server.

Would you send me the file please so we can investigate the problem.

james.ussher-smith@vbulletin.com

Thanks.

i did send it to firefly ;) this is the first thing i did.