password protection without htaccess

Hi Im sorta new at using apache and I think I understand htaccess well
enough to get it to work in tests... allowing overrides in specific
directories only and then adding htaccess files in them.

But the documentation says its much preferable, when available, to use the
config file only and not to allow htaccess at all. I saw one example where
the lines that would go in htaccess instead go in between <directory>
</directory> in the config file... still pointing to an external password
file I assume. Does this sound right?

I also read about using PHP & SQL instead as a better alternative. That
should be no problem but how does this protect against someone bypassing
the php file by entering the URL of the protected files directly? Does each
file have to look for some kind of "passed" variable? The only thing that
comes to mind is an include file, added to everything, that checks for the
variable and redirects to some other page if its wrong. Does THAT sound
right?

Thanks everyone!

Theo <invalid DeleteThis @noemail.com> wrote:
 > Does this sound right?

Yes.

 > should be no problem but how does this protect against someone bypassing
 > the php file by entering the URL of the protected files directly?

The idea is that the 'protected' file isn't there until you are authorized
and after you get it is deleted or is a .php file itself and check if you
are authorized or not before showing himself.

Davide

--
| A fool must now and then be right by chance.
|
|
|<!-- ~MESSAGE_AFTER~ -->