Handling confidential files

[eluser]Colin Williams[/eluser]
"Your thinking is spot on" = "You are correct"

You wouldn't be protecting it with .htaccess, but that would probably be part of the system. You could have the rewrite rules in any Apache configuration. What protects the file is your PHP script, which Apache would have invoked to handle the request.

If a file is called directly (assuming somebody found out path and filename), PHP has nothing to do with it anymore and can’t give any protection.

Again, this is true only if you have Apache configured in such a way that it is responsible for serving the file. With the right configuration, PHP will be invoked to serve the file.

By the way, what is your native language?