title: can a hacker aqquire access to a users env variables?
body: <p>people say to put pwds in envariables instead of config files</p>
  <p>can a hacker access env vars through a trojan?</p>
  <p>if I put my pwds in a .php file, it will be interpreted and nothing goes to client</p>
  <p>the file sys security is old and tested so I trust .php</p>
  <p>but what about env vars?</p>