title: How secure is storing DB variables with SetEnv or in php.ini?
body: <p>I don't like storing sitewide crypto keys and DB access information under document_root, so I was using Apache's SetEnv and php.ini files under conf.d to separate these from the codebase. The big question is, which one is better? Inside environment variables under apache vhost files (<code>SetEnv SITEKEY 'oinkoink!'</code>) or inside conf.d/xxx.ini files (<code>db_pass="oink?"</code>)? Maybe something else?</p>
  
  <p>PROS n CONS:</p>
  
  <p>SetEnv:</p>
  
  <p>+Stored outside DOCUMENT_ROOT<BR>
  +Only the given vhost has access<BR>
  -Visible with PHPINFO() - Hacker needs direct access/upload exploit to files<BR></p>
  
  <p>get_cfg_var:</p>
  
  <p>+Stored outside DOCUMENT_ROOT<BR>
  +Not visible with PHPINFO()<BR>
  -(VERY BAD) All the defined ini variables are included, so each vhost can query them via (ini_get_all), so not usable in a shared vhost environment <BR></p>