Question

I’m working on a PHP project and I’m using a global settings file which I include where I need some global values such as database credentials for connecting to mysql.
For example:

settings.php:

<?php          
    const DB_ADDRESS = 'localhost';
    const DB_USERNAME = 'johndoe';
    const DB_PASSWORD = 'mypassword';
    const DB_PORT = 7777;   
?>

My question, is it safe enough?
For example, is there any way to see variables values while debugging in explorer/chrome?
Is there any alternative safer way?

Thanks.

Answer 1

PHP information is processed on the server before being sent to the browser so it can’t be seen inside of a browser under normal circumstances. However, if your webserver is misconfigured the plain text version of your code may be sent to the browser thus rendering it visible to users. That’s why important code should always be kept outside of your document root and included into files when needed.