Protecting XML config files
 

How can I protect xml config files from viewing by the user, yet allow my script to read it?

if in .htaccess I deny .xml, then the script can't read it...

Any solution to this?

Put it outside your web directory, access it via path.

...if you put it in .htaccess, the script will be able to read it. htaccess controls files served by apache to the OUTSIDE world - if your script is on the same machine with the right permissions you will be able to read it.

How are you reading the XML file? .htaccess shouldn't block you from reading it unless you use a URL to open it. Use the local path instead.