title: Where should I place sensitive files so that they are read-able by PHP scripts?
body: <p>I am on a Parallels/Plesk VPS host, and this is a really newbie question.</p>
  
  <p>The webroot is at:</p>
  
  <pre><code>/var/www/vhosts/my-domain-name/httpdocs
  </code></pre>
  
  <p>There is also a path called:</p>
  
  <pre><code>/var/www/vhosts/my-domain-name/private/
  </code></pre>
  
  <p>But PHP scripts can't seem to read files in there.</p>
  
  <p>From my understanding any file placed within the webroot, is in danger of being served to the public if requested by its web-path/filename. I am vaguely aware of the use of .htaccess files to tell Apache not to serve certain files/dirs.</p>
  
  <p>But can (or should) I place my sensitive file somewhere <em>outside</em> of the webroot, while still allowing it to be read by PHP scripts?</p>
  
  <p>Thank you!</p>
  
  <p>Here were my errors when trying to read a file within the "private" folder above:</p>
  
  <pre><code>Warning: file() [function.file]: open_basedir restriction in effect. File(../../private/test.txt) is not within the allowed path(s): (/var/www/vhosts/blah.com/httpdocs:/tmp) in /var/www/vhosts/blah.com/httpdocs/misc/testscript.php on line 8
  
  Warning: file(../../private/test-dt.txt) [function.file]: failed to open stream: Operation not permitted in /var/www/vhosts/blah.com/httpdocs/misc/testscript.php on line 8
  </code></pre>
  
  <p><strong>UPDATE: SOLVED</strong></p>
  
  <p>Picto at reddit/r/PHPHelp gave me what I needed, and it is specific to Plesk systems.
  I had to write a file called vhost.conf placed in the conf folder which exists at the same level as httpdocs. And in the vhost.conf, I used:</p>
  
  <pre><code>&lt;Directory /var/www/vhosts/my-domain-name/httpdocs&gt;
  php_admin_value open_basedir /var/www/vhosts/my-domain-name/httpdocs:/tmp:/var/www/vhosts/my-domain-name/myfolder
  &lt;/Directory&gt;
  </code></pre>
  
  <p>So I now place my sensitive files in "myfolder", which is outside of the webroot (httpdocs).
  After this, to make these settings take effect, (restarting Apache doesn't work) there are some Plesk specific commands to give, see: <a href="http://www.gadberry.com/aaron/2006/02/09/plesk_vhost/" rel="nofollow">http://www.gadberry.com/aaron/2006/02/09/plesk_vhost/</a></p>