php vs .htaccess：阻止访问php文件的最佳方法是什么？

Question

I'd like to know what is the best practise to prevent access to all php files except the index.php and a few others. I know you can do it by checking the values of a costant in php or via the .htaccess file. But what is the best way in terms of performance and good coding practices? Thanks

EDIT: I mean prevent read and execute access to the public

Answer 1

Don't put PHP files in the web root.

For instance:

phpincludes
   - database.php
   - file123.php
   - functions.php
public_html
   - index.php
   - otherstuffhere.php

Can't access what's not there!

Answer 2

The best practice is to simply not put your application code in your web server's doc root. Have a single index.php in the root that handles instantiating controllers to do all of the work. All the rest of your code doesn't have to be directly accessible as long as the index.php can include it.