Scripts can only write to the htdocs directories they are in. Any directories outside the htdocs dir cannot be written - due to the open_basedir restriction (is set for security reasons).
also
If you create some directory in htdocs and you add a .htaccess file with the content Require all denied, then nobody will be able to access the files directly either.