I am going through the 2nd chapter of this Django tutorial(Creating a Project) : https://docs.djangoproject.com/en/1.8/intro/tutorial01/<p>I created a folder called "Weiqi" in my home directory. (named after the game I am best at!)<p>Then I typed the command $ cd Weiqi in the "Terminal"<p>CaiGengYangs-MacBook-Pro:~ CaiGengYang$ cd Weiqi --- input<p>and got this output :<p>CaiGengYangs-MacBook-Pro:Weiqi CaiGengYang$ --- output<p>Then I ran the following command in the Terminal : $ django-admin startproject mysite.<p>This created a mysite folder which appeared inside the original Weiqi folder in my home directory.
When I clicked on the mysite folder, there is a manage.py file and another mysite folder inside the original mysite folder.<p>When I click on the mysite folder, there are 4 files in it : __init__.py , settings.py , urls.py and wsgi.py.<p>The next chapter of the tutorial says this :
"Where should this code live?<p>If your background is in plain old PHP (with no use of modern frameworks), you’re probably used to putting code under the Web server’s document root (in a place such as /var/www). With Django, you don’t do that. It’s not a good idea to put any of this Python code within your Web server’s document root, because it risks the possibility that people may be able to view your code over the Web. That’s not good for security.<p>Put your code in some directory outside of the document root, such as /home/mycode."<p>I am a little confused about the last paragraph : What exactly is a "directory outside of the document root, such as /home/mycode." and how do you "Put your code in this directory" ?
Your document root is probably /var/www<p>Your web server will let any visitor read the contents of that folder. If you put your code in there, then other people could read your code. When you were using php, this was ok, because your web server knew that it should not let people read your php files, but instead run the file and serve the output of the file.<p>With python, it's not the same. Your Python application acts as a whole. People aren't calling specific files like <a href="http://www.ggg.com/manage.py" rel="nofollow">http://www.ggg.com/manage.py</a><p>They request a page from your server. The server knows how to use a wsgi file. The wsgi file runs your code, and tells it what the user requested. Your code returns a response, which the web server sends back to the user.<p>This code can live in any folder on your server, but if you want to keep people from seeing your code and database credentials, then it should not be in /var/www, but somewhere else. The book suggests your home folder. If you don't know what that means, find a tutorial on basic command line or basic Linux.<p>Good luck.