Question: I read it's good practice to store php files containing potentially security risk stuff outside the root directory.

Now I have php files containing stuff for proccessing a registration/login. Those are outside the root directory.
Now I catch the form content via jquery and send it to this php file.

But this seems not to be possible with js/jquery:

```
$.ajax({
    type: "POST",
    url: "../php_includes/register.inc.php", //beyond root path
    data: data,
    })
    .done(function(data, status) {
            //...
    });

```

Do I have a design error or just doing something wrong?

Whats the "best practice" solution here?

Answer: 
A "best practise" would reduce the number of entry points to 1. Rather than having `index.php`, `login.php` and `register.php` you have just one file `handler.php` that handles *all* incoming requests (aided by rewrite rules).

`handler.php` bootstraps your application and contains routing information that determines how a request should be handeld. Modules in your application can register routes and that is how that code gets activated.

All your code can be stored outside of the webroot, only `handler.php` is exposed. And `handler.php` can be as simple as:

```
<?php
include(__DIR__ . "/../includes/bootstrap.php");

```

Rewrite rule to capture all requests:

```
RewriteEngine on
RewriteRule ^(.*)$ handler.php?path=$1 [QSA]

```
You'd rather store security-related stuff like configuration files and alike in an external (non-accessible) directory. But if you need to access information stored in these files, you have to create a controller that will filter the access and provide the information in a secure way if needed.

Apache will not serve files that are not located in the website's root directory.