制作主题文件.html

Question

They have some php code within (if, endif, variables), but essentially they are html files.

Do you think is a good idea to use the .html extension and prevent direct access to them trough .htaccess, so the php code is not visible to anyone ?

Is it safe?

Answer 1

can you test the script?

As far as I know the PHP is just server-side so after the server "do its thing" it doesn't show on the users computer (when he tries to see the source code).

Javascript and HTML are displayed but not the php.

I have used the .htaccess file to block some other files in the folder such as the DB credentials and such that I had named .inc (for include). If you block the html with the htaccess noone is going to be able to see the webpage.

I hope I understood it right! (And clarified it as well)

Answer 2

Just have an .htaccess with deny from all in the views folder... ;p

Tho if you have files like images or css that you want loaded from that theme folder then by all means rename the view to .php and put as this on the first line:

if (!defined("RUN")){die('No direct access');}

Obviously define('RUN',true); in your config.