Purpose of the .htaccess files in the Drupal files directory?

Question

Besides the .htaccess file in the Drupal site main folder, I've found a .htaccess file in the sites\default\files folder, and further such files some sub-folders of sites\default\files folder (for example, in sites\default\files\private).

My question can actually be broken down into two separate questions:

1. How would you define in simple words the purpose of both the main .htaccess files, and the others under sites\default\files (I assume there aren't anymore .htaccess files?).

2. Is the only reason for splitting the Python syntax to different .htaccess files is to not make a single huge file? Or there are other reasons?

Thanks,

Answer 1

The first .htaccess file in the root directory is for routing and to override any PHP related settings.

The second .htaccess file under sites/default/files is for security purpose, to avoid any file injection. This folder is Drupal's main upload folder.

The upload folder can be moved in different places, or in a multi site setup you could have more than one folder. That is why they provided a separate .htaccess instead of putting everything in one place.