Question

I have an config.php file where I simply make an huge array that contains all the framework configuration. Also the database source string thing like “mysql:host=localhost;dbname=mydb” (whats that called, btw?) and username + password for DB. I’m afraid this is:

1. stupid
2. not good; better solution there
3. not secure (?)

so how do the PHP experts do that?

Answer 1

That’s how most do it, but you could also try some of these solutions:

• Save the configuration file outside the web folder (this requires that the open_basedir configuration in PHP is disabled).

• Restrict access to the configuration file by using .htaccess:

  <Location /config.php>
  Order deny,allow
  Deny from all
  </Location>

• Use .ini files and the parse_ini_file function (this is not really a solution in itself, but could be combined with the others)