As per Drupal's folder structure, custom code is always in sites/modules or in the theme folder. One of my colleagues created a custom PHP file in the files folder. Is this OK or are there any security issues?


Files under that folder are writable by the web server. You could argue that makes it a security risk, but your server would already have to have been compromised in one way or another for it to become so. If your server is configured properly it will only execute PHP files, not serve them for plain-text download.

From the point of view of convention, though, you shouldn't do this. Putting code files all over the file structure makes maintainability infinitely harder.


You should guarantee that this PHP file will be executed only by authorized parties by implementing access checking inside the file, or browser headers cheking, or .htaccess, or file system read/write permissions.

By default, PHP files cannot be read by HTTP requests, only executed if .htaccess or the web-server is properly configured.

And you can place your files whereever you want, but you must make sure, that you follow the Drupal logic as a framework and follow the agreed usage conventions.


Drupal's .htaccess file will try to prevent this by adding the line to an .htaccess file in the files directory:

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006

If you remove that line then the code will execute, but you are making your site less secure in the case that a file upload module doesn't properly use file_munge_filename.

I would avoid putting scripts into the files directory if at all possible. Instead you can place them into a module directory or the Drupal root or into a sub-folder inside your Drupal root that will make it obvious what they are: "site-scripts/"

Doing things in a standard way makes it easier to manage your site in the long run. It also increases the likelihood that another person who takes over the site for you will be able to quickly learn how to do key tasks like upgrade it.

There are also modules and tools which will look at the files directory and delete any files that are not "managed" by Drupal (i.e. that are not in the "files" database table). If you put your .php files in that directory there is a chance at a future date they will be deleted.

For security and maintainability and stability I just can't see a good reason to put executable scripts into the files directory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.