title: What permissions for PHP scripts/directories?
body: <p>I am trying to help a friend moving a web-site from one web-hotel to another. 
  The old place is already closed, I have only a flat tar file of what was in it.</p>
  
  <p>The web site contained HTML docs and one could download a little Java application (to be loaded on mobile phone) to send data to the web site.</p>
  
  <p>The mobile Java application sent a string to <code>URL=&lt;HOST&gt;/php/register.php</code>. This php script included another php script (<code>../inc/db_login.php</code>), which connected to a SQL DB using <code>$link=mysql_connect()</code>. Another file, <code>register.php</code>, did the SQL insert for putting the new sent data in the DB.</p>
  
  <p>My question is basicaly, where I should put this 2 PHP files on the new website and what permissions the directories and files should have?</p>
  
  <p>The old web server obviously had a <code>/php</code> and <code>/inc</code> directories. None of these exists on the new webserver. Should I create them? What permission should they have? I guess the reason for having the password in a separate PHP file was security. The <code>/php</code> and <code>/inc</code> directory probably had different permissions.</p>
  
  <p>The new server has directories:</p>
  
  <ul>
  <li><code>/httpdos</code></li>
  <li><code>/httpsdos</code></li>
  <li><code>/cgi-bin</code></li>
  <li><code>/conf</code> (and some others probably irrelevant)</li>
  </ul>
  
  <p>My questions</p>
  
  <ol>
  <li><p>Does the file-extension (<code>.php</code>) mean something to the server: as PHP scripts are "included" in HTML code (between <code>&lt;?...?&gt;</code>, does the server need to look at the file suffix or is it irrelevant? (I understand that the server reacts on the <code>&lt;?...?&gt;</code>, of course)</p></li>
  <li><p>should the public file (<code>register.php</code> in my case) be placed in the <code>httpdocs/</code> directory or does the server (apache I think) reacts on something and fetches it in another directory?</p></li>
  <li><p>Should the PHP script have permission <code>R-X</code> (read and execute), <code>--X</code> (execute) or <code>R--</code> (read)? From a OS perspective I guess apache is just reading this files, meaning that they should be <code>R--</code>, but this would mean that if PHP service is "stopped" the client would get all the PHP code in his browser(?). I would prefer it being <code>--X</code> but as this is neither a binary nor has a <code>#!</code>, I guess it must be <code>--R</code>?</p></li>
  <li><p>If the public PHP script can be placed in another dir (e.g <code>/php</code> instead of <code>/httpdocs</code>) what should <code>/php</code> (and the script) have for permission?. I guess the server has to know about this <code>/php</code> directory (or are there usual defaults?)</p></li>
  <li><p>The PHP script included (<code>../inc/db_login.php</code>, containing SQL password) should not be under <code>/httpdocs</code> I guess. This means that my <code>register.php</code> is including a file which is not under the <code>/httpdocs</code> subtree. Does this work? Does the server need to know?</p></li>
  </ol>
  
  <p>I understand you may need to know the server configuration. Just assume the default in your answer (and you can tell where it is changed if it is).</p>