I manually made a php file that has the ability to connect to the database and create table entries, it works fine, but now the problem is that if I leave it there, anyone will be able to access it to create entries.

So I want to restrict the access to that file to only authenticated users, I think this may be posible using the .htaccess file, but I don't know how just yet.

1 Answer 1


.htaccess won't help with this; Apache doesn't know what an authenticated Drupal user is, and there's no easy way to grant it that knowledge. Fortunately there's a much better option:

Create a route in a custom module, and execute your code in its controller. You can easily protect the route with permissions, or by role. Aside from the flexibility this gives you around access control, you can also refactor your custom DB code to use Drupal's database API, making your code more future-proof.

The other option, less desirable IMO for your requirements, is to bootstrap Drupal in your custom PHP file, and use the current_user service to determine whether the user has access to your script.

  • And inside the controller you can always use the drupal way of writing queries, with entity query api etc... now it depends on your use case but I personally believe it's always better @julianx2rl Commented Feb 12, 2021 at 9:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.