How to secure database configuration file in project? [duplicate]

Question

This question already has answers here:

How to secure database passwords in PHP? (17 answers)

a better approach than storing mysql password in plain text in config file? (8 answers)

Closed 9 years ago.

I have created on php file for establishing connection with database server. In this file, i am using mysql_connect() function with parameters host, username and password of my database server.

public class DatabaseConnect
{
function __construct()
{
    mysql_connect('localhost','username','password') or die('Could not connect to mysql server.');
    mysql_select_db('databasename');
}

}

Now in this case, username and password are visible to others.

I found one more way to secure the value i.e. mysql.default_user and mysql.default_password. In which scenario we have to this way?

Or how could i secure my values from others?

Answer 1

You can try to put your database credentials in separate file with proper UNIX permissions set, for example 644, and then include this file on top of your script.

The configuration.php file will look like:

<?php
define (DB_USER, "mysql_user");
define (DB_PASSWORD, "mysql_password");
define (DB_DATABASE, "database_name");
define (DB_HOST, "localhost");
?>

Your original script will look something like this:

require ("configuration.php");
public class DatabaseConnect
{
function __construct()
{
    mysql_connect(DB_HOST,DB_USER,DB_PASSWORD) or die('Could not connect to MySQL server.');
    mysql_select_db(DB_DATABASE);
}

}

Answer 2

Now in this case, username and password are visible to others.

Only to those, that have access to your source code. This should not be a problem. But if you want to separate code and database credentials, make sure that the configuration file is located outside the web root.