Best Practices for creating a PHP INI/CONFIG file and keep it secure

StackOverflow https://stackoverflow.com/questions/1650629

  •  22-07-2019
  •  | 
  •  

Question

I always used a normal PHP file and just defined the variables in that file, but is this considered best practice?

Example:

<?php

define('DB_PASS', 'p@ssw0rd');

?>
Was it helpful?

Solution

It is quite safe and I don't think there is any best practice for constants, but I tend to gather them in a dedicated Constants class for readability:

class Constants {
    const DB_PASS = 'mypass';
}

OTHER TIPS

Naming your PHP file something that begins with .ht (for instance .htconfig.inc.php) also helps, since Apache usually has a rule never to serve any files that are named .ht*. But placing your file outside of the document root is even better.

unless someone has access to your PHP source code that is secure.

however I would make sure the file is outside of the document root to prevent problems IF for some reason php gets turned off on the website and all of a sudden people can see the source of your files :).

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top