security - PHP writing to a text file on server -

i have log process writes little custom .txt log file on server when people supply input on particular form (so can keep eye on trying use injection).

my question: file plaintext, , not link anywhere in code other php calls file_get_contents , file_put_contents. there way see file? search engine possibly find it?

(i understand security obscurity. question how 1 might possibly "unobscure" this.)

i understand security obscurity. question how 1 might possibly "unobscure" this.

they need able know site’s code structure & logic. if name directory logs stored in other logs/ first decent step. or keep directory named logs/ have nested in directory know such my_cool_stuff/logs.

if want sure nobody get’s it, can set apache config rule block directly reading .txt files directly browser, use apache files directive in web site’s apache config or in .htaccess on site:

<files ~ "\.(txt|yml|yaml)$">   order allow,deny   deny </files> 

and official apache documentation states placement of files directives:

note unlike <directory> , <location> sections, <files> sections can used inside .htaccess files. allows users control access own files, @ file-by-file level.

so place in .htaccess file on server’s root , tells apache, “do not allow directly access files end .txt, .yml or .yaml extension directly via web server.”

now people recommend place file 100% outside of main web root. , maybe help. let’s malware infection gets code & can browse directory structure—which happens more not—then doesn’t matter virtual rock hide data under: exposed can penetrate system & have same access rights web user.

or put simply: if apache can access directory & read file, if site penetrated, malware penetrates have exact same access rights apache & can read files & directories pretty anywhere apache can.

that’s why feel “security through reasonable obscurity” best real world tactic. block direct access files not want parsed through web browser, place files in reasonably obscure location—even if in web root—and call day.