[FX.php List] Web Root Directory - clarifying exactly *which* folder?

[Joel Shapiro]

Hi all

I know it's a good idea to keep passwords etc out of the web "root  
directory" so no one can access them via the Web.  I generally err on  
the side of caution but am curious about exactly *which* folder that is.


On OS X, with the path:  HD/Library/WebServer/Documents/

anything outside the Documents folder is safe, even if still inside  
the WebServer folder?


On Windows, with the path:  C:\Inetpub\wwwroot\

anything outside the wwwroot folder is safe, even if still inside the  
WebServer folder?


Is that right?


TIA,
-Joel