Take the 2-minute tour ×


share|improve this question
add comment

16 Answers

up vote 107 down vote accepted



share|improve this answer
yep, I usually do DEFINE("DB_NAME","mydb"); etc it is also handy to define anything you'll be using on more then page, that you might want to change later –  Matthew Rapati Sep 19 '08 at 3:33
@gnut: " I just store it outside the web root. ". How string it outside webroot would help? I am asking this as I have seen in even modern open source scripts that the config file which contains the db password is in root. I dont prefer this and I wanna know if I sould bother. –  C graphics Aug 25 '12 at 22:59
show 5 more comments


<files mypasswdfile>
order allow,deny
deny from all
share|improve this answer
Useful, if it's truly secure, though it seems like a shell login would still have access. –  Kzqai Apr 14 '10 at 16:10
add comment

Store them in a file outside web root.

share|improve this answer
Yes, very good point. –  da5id May 26 '09 at 21:29
add comment


share|improve this answer
add comment




unset ($db_user, $db_pass);
share|improve this answer
add comment



This is how you specify these values in those files:

php_value mysql.default.user      myusername
php_value mysql.default.password  mypassword
php_value mysql.default.host      server

Then you open your mysql connection like this:

$db = mysqli_connect();

Or like this:

$db = mysqli_connect(ini_get("mysql.default.user"),
share|improve this answer
Could one use this in their .htaccess file? –  user1193509 Aug 18 '12 at 17:49
add comment

Best way is to not store the password at all!


share|improve this answer
add comment



share|improve this answer
add comment



  • Don't use the combination of username/password for anything else


share|improve this answer
add comment



share|improve this answer
add comment

I think the OP means the database password.

Unless someone gains access to your server via FTP or SSH (in which case you're already buggered), I wouldn't worry about storing passwords in plaintext in PHP files. Most PHP applications I've seen do it that way, for example phpbb.

share|improve this answer
add comment


<?php exit() ?>


Plain text data including password



share|improve this answer
add comment

Storing something outside the webroot which can't be accessed from the web is a smart move. Then require() this file and use this with the mysql_connect . On my webhotel I have this file where all of my subdomain-folders are. So I've created a function that returns the password because I use multiple database-accounts.

function returnDatabasePassword($username) {
  $passwords = array(
    'db_username' => 'password',
    'db_username2' => 'anotherPassword'
  return $passwords[$username];
share|improve this answer
Do you hide passwords from another programmers of your team in such a way? Why another programmer can't write require() for this file and call this function and echo returned passwords? –  Innuendo Sep 25 '11 at 4:18
If someone can run code on your server, (s)he can do anything. You have much bigger problems. That said, if you can't trust others on the same server, you should be using different user accounts. Then you can make sure with Unix permissions that only the user that runs your web server has access to the file. Ofc. that assumes that the web server for the other, untrusted domain runs as a different user. Otherwise you're screwed. –  uliwitness Sep 23 '12 at 13:51
add comment
  1. Create an O/S user for your application
  2. Create an O/S environment variable for that user, with the password
  3. Run the application as that user


  2. You won't accidentally screw up file permissions
  3. Survives reboot
  4. Can only be read by root or that user
  5. If you use encryption, how are you storing the key securely?
  6. Works x-platform

This method is suggested by Heroku, who are very successful.

share|improve this answer
add comment


share|improve this answer
add comment


  1. disallow database access from any servers outside your network,
share|improve this answer
add comment

protected by Bill the Lizard Sep 10 '10 at 11:13

