Protecting XML config files

[Project Manager]

How can I protect xml config files from viewing by the user, yet allow my script to read it?

if in .htaccess I deny .xml, then the script can't read it...

Any solution to this?

[lacuna]

Put it outside your web directory, access it via path.

[SilentSound]

...if you put it in .htaccess, the script will be able to read it. htaccess controls files served by apache to the OUTSIDE world - if your script is on the same machine with the right permissions you will be able to read it.

[sysk]

How are you reading the XML file? .htaccess shouldn't block you from reading it unless you use a URL to open it. Use the local path instead.