Question

I am trying to obfuscate a MySQL password within my PHP source code, because it is displayed publicly on Github. Here is what I did:

$pword = file_get_contents('../.brown_bag');
$obj->password = $pword;

This doesn’t work, I get an access denied error. The file, .brown_bag, contains only one line with a string of only letters. I’m pretty sure file_get_contents() is not returning the data that I expected. I was trying to write concise, simple code and so have avoided the whole fopen rigmarole. Why doesn’t this work, and is there a better way?

Answer 1

As to why it does not work, have you tried echoing out the value read from the file? It might be something as simple as a space or new-line, so you could try:

$obj->password = trim($pword);

An alternative would be to just add a example config file to github and not the real one, for example just add config.php.example with empty or example values.