PHP library inside or outside the document root?

Question

I am writing a PHP library based on the zend framework. My library is used by several of my web projects. I am not sure where I should put my library. It seems to make sense to have it outside the document root from individual projects, so I don’t need to maintain a library in every single project. My current setup looks like this:

/var/www/vhosts/project1/ /var/www/vhosts/project2/ /var/www/vhosts/libraries/zend-framework/zend-framework-1.11.0/... /var/www/vhosts/libraries/my-lib/my-lib-1.0.0/... 

Thus, in my projects specific versions of zend-framework and my-lib can be used.

An alternative setting would look like this:

 /var/www/vhosts/project1/ /var/www/vhosts/project1/libraries/zend-framework/zend-framework-1.11.0/... /var/www/vhosts/project1/libraries/my-lib/my-lib-1.0.0/... /var/www/vhosts/project2/ /var/www/vhosts/project2/libraries/zend-framework/zend-framework-1.11.0/... /var/www/vhosts/project2/libraries/my-lib/my-lib-1.0.0/... 

The first version makes more sense to me, but I'm not sure if I encountered some security problems if my projects depend on files outside the document root folders. Also, I am having problems when I try to include javascript files from my-lib in my projects if my-lib is outside the root of the project document.

What is the best practice here where should I put my library and zend framework?

Answer 1

If / var / www / vhosts / libraries is accessible externally, I would recommend that you place your library one level down (/ var / www / libraries) so that:

• you can share the same lib with all your PHP applications.
• PHP can access it without setting permissions
• it is not available directly from the first sites