php - Storing script files outside web root -

I have seen recommendations for storing some or all php, web document root directory (username / public_html in my case) Due to keeping php files secure with sensitive information (such as database connection and login information), the web server stops protecting hiccup and php files and they become 'visible' to external people asked me to do Are.

It looks like I'm feeling insane, but I think people have burned very badly before that, so I'm ready to go together. The suggestion usually takes a few files as '../include_files/', so it is not directly in the document root and does not access the external people directly through the web server

My question is this: Is there any significant difference between security in this way and just by inserting our 'include_file' directory under the document route and pasting the .htaccess file there (with the appropriate entries)?

TIA,

Monte

Using the .htaccess adds an overhead because of Apache for another item,

Check and process it

Keeping files out of the web root is not going crazy, this is a good practice. What happens if someone directs one of the "included" files directly and reveals these errors because all pre-requisite files were not loaded?

To ensure each file is running under the required environment, it will have to do its own security check. Each executable file in the web access area is a potential security hole.