Question

I have all of my database credentials within an include file that I wanted to place outside of my webroot file.

However, my shared hosting plan does not allow me to place files outside of the webroot. Would I have to look at encrypting my file in some way to make sure my credentials are secure?

I had read a method to produce a kind of fake 404 page, but that doesnt sound very secure to me at all.

I’ve also taken the step of creating a read-only user account so that if my account is compromised then at least nothing can be overwritten or dropped, but I obviously want to be as secure as I can given the limitations.

Answer 1

You can’t

Best what is possible is create php file which will be interpreted by hosting service.

<?php

$DB_USER = 'your_user';
$DB_PASS = 'your_pass';
$DB_INSTANCe= 'your_instance';

When someone will access your file from web browser he won’t see anything. When you need your file just include it.

You could also add some .htaccess (probably) so no one using web browser will be able to access your file.

Someone who has read access to the same physical host as you will be sadly able to access this file, and there is no way to prevent that.