How to secure database configuration file in project?

Question

I have created on php file for establishing connection with database server. In this file, i am using mysql_connect() function with parameters host, username and password of my database server.

public class DatabaseConnect
{
function __construct()
{
    mysql_connect('localhost','username','password') or die('Could not connect to mysql server.');
    mysql_select_db('databasename');
}

}

Now in this case, username and password are visible to others.

I found one more way to secure the value i.e. mysql.default_user and mysql.default_password. In which scenario we have to this way?

Or how could i secure my values from others?

score 9 · Accepted Answer · answered Feb 19 '13 at 08:26

9

You can try to put your database credentials in separate file with proper UNIX permissions set, for example 644, and then include this file on top of your script.

The configuration.php file will look like:

<?php
define (DB_USER, "mysql_user");
define (DB_PASSWORD, "mysql_password");
define (DB_DATABASE, "database_name");
define (DB_HOST, "localhost");
?>

Your original script will look something like this:

require ("configuration.php");
public class DatabaseConnect
{
function __construct()
{
    mysql_connect(DB_HOST,DB_USER,DB_PASSWORD) or die('Could not connect to MySQL server.');
    mysql_select_db(DB_DATABASE);
}

}

answered Feb 19 '13 at 08:26

Bud Damyanov

30,171
6
44
52

Just used copy and paste on your config file specification (blame me ;-)). Had to add quotes around variable names to make it work. – LSA Feb 17 '17 at 22:29
`get_defined_constants()` can easily expose them to evil developers. – twodee Apr 06 '17 at 08:22

score 5 · Answer 2 · answered Feb 19 '13 at 08:24

Now in this case, username and password are visible to others.

Only to those, that have access to your source code. This should not be a problem. But if you want to separate code and database credentials, make sure that the configuration file is located outside the web root.

How to secure database configuration file in project?

2 Answers2

Linked