PHP library inside or outside of document root?

I'm writing a PHP library based on the zend framework. My library is used by several of my web projects. Im not sure where I should put my library. It seems to make sense to have it outside of the document root of the individual projects, so I don't have to maintain the library in every individual project. My current setup looks like this:

/var/www/vhosts/project1/
/var/www/vhosts/project2/
/var/www/vhosts/libraries/zend-framework/zend-framework-1.11.0/...
/var/www/vhosts/libraries/my-lib/my-lib-1.0.0/...

Like this, specific versions of both the zend-framework and my-lib can be used in my projects.

An alternative setup would look like this:

/var/www/vhosts/project1/
/var/www/vhosts/project1/libraries/zend-framework/zend-framework-1.11.0/...
/var/www/vhosts/project1/libraries/my-lib/my-lib-1.0.0/...
/var/www/vhosts/project2/
/var/www/vhosts/project2/libraries/zend-framework/zend-framework-1.11.0/...
/var/www/vhosts/project2/libraries/my-l开发者_C百科ib/my-lib-1.0.0/...

The first version makes more sense to me, but I'm not sure if I run into some security problems if my projects depend on files outside of their document root folders. Furthermore, I experience problems when I try to include javascript files from my-lib in my projects if my-lib is outside of the projects document root.

What's best practice here, where should I put my library and the zend framework?

---

If /var/www/vhosts/libraries is accessible from outside, I'd recommend you put your library one level lower (/var/www/libraries) so:

1. you can share the same lib with all your PHP apps
2. PHP can access it without tweaking the rights
3. it's not directly accessible from the front sites