Hi, what exactly is the problem with config.inc.php being world readable? issnt every file readable by the web server 'somehow' world readable? and issnt it so if /www is only user and group readable that /www/myweb/config.inc.php is secure enough? or is this just a sf.net specific problem, cause all webroots are world readable? (btw. i am a little bit annoyed by the fact that i have now set my read only flag for config.inc.php after every change on it on my developer machine (Windows)) -- Sebastian Mendel www.sebastianmendel.de www.sf.net/projects/phpdatetime | www.sf.net/projects/phptimesheet