Just "deny from all" is enough, the .htaccess is included in the zip package , in the data folder, this will prevent malicious web user to try writing in the /data/ folder which is often set to too much write permissions and this leave access only to the script accessing files without your webservers but localy. You can set the same .htaccess file in the /includes/ folder of vb for example, this is always good to restrict all folders (with chmods+web server directives) that are supposed to be called only with php.
|