有人可以从public_html下载我的文件吗？

Question

When someone accesses a site via url www.mysite.com/index.php the php code is executed server side and you can't see the code. Can someone download my files such as index.php from my folder public_html somehow (other than hacking into my account with my password) and view my php code?

Answer 1

除非您的服务器受到威胁或您的脚本编码不正确，否则攻击者无法访问他想要的任何文件，否则不会。

Answer 2

Depends. If you are on a crappy shared host, it's not impossible that you can look into other people's PHP files -- this often only requires guessing the username and consequently the absolute path to the file you want to see. You can't list the directories leading there but alas sometimes if you know the absolute path then you can read others file. Say, you are joe and the path is /home/j/joe/public_html/joesdomainname/index.php how long will it take for jack to figure this out when he sees /home/j/jack/public_html/jacksdomainname/index.php ...? The cost of this attack (which is not by all means a sure short) is creating an account with the same company you are with. As this mostly works with truly crappy shared hosts, that cost won't be particularly high...