title: PHP Security - Database Credentials in Docroot
body: <p>Is it considered secure to have your security credentials for a MySQL connection in the PHP file that is being requested from the server? For example, does <code>localhost/query.php?param=1&amp;param=2</code> pose a threat if the first lines of <code>query.php</code> are credentials to connect to the databse? </p>
  
  <p>Edit: Judging by the immediate comments and downvote, I want to clarify the params are not the credentials themselves, but they exist at the beginning of the <code>query.php</code> file. Is the only downside (a big one) that if your server has a problem processing your PHP that it will send the credentials in plaintext?</p>