Encryption Key in config file

[eluser]xwero[/eluser]
The install in the public directory you have to look at as a lazy/exploring CI install. The index.php is not in the system directory so it's very easy to put the system directory outside the root and the index.php file in the root.

Like i wrote before you have to secure on several levels to secure passwords or keys but if you secure too much it will have performance consequences.

if you allow users to upload php files store them with a non execution extension. If you allow snippets escape the execution trigger, for php <?php to <?php.