Question

In the code given below, I am trying to modify it in such a way that the db connection variables are used from a config file. This should make the password more secure as I can restrict the config file’s permissions.

Kindly let me know if there is a way by which I can modify the code to get the db variables from another file/config file?

class ActivitycodesCollection {
    var $list, $err, $sql;    
    // --- Private variables for database access
    var $_db_host = "######";
    var $_db_username = "######";
    var $_db_passwd = "######";
    var $_db_name = "######";
    function query ($where="") {
        mysql_pconnect ($this->_db_host, $this->_db_username, $this->_db_passwd);
        mysql_select_db ($this->_db_name);
        $where = "WHERE " . $where;
        $sql = "SELECT * FROM activitycodes $where";
        $result = mysql_query ($sql);
        $this->err = mysql_error();
        $this->sql = $sql;
        if (mysql_num_rows($result) > 0) {
            while (list($id) = mysql_fetch_array ($result)) {
                $this->list[$id] = new activitycodes($id);
            }
        }
    }
}

I tried including the config.ini file in this class/function but it threw an error like

unexpected T_VARIABLE, expecting T_FUNCTION

Answer 1

Your code is hopelessly outdated.
1) Don’t use var for properties, use private or protected.
2) Don’t use mysql_* functions, use PDO.
3) Don’t keep connection details inside the class. Just require PDO connection in constructor.
4) Don’t trust any data outside your scope – don’t allow just write some untrusted text into your SQL query (you do it by $where variable).
5) Read books. “PHP Objects, Patterns, and Practice” will help you now, and “Clean code” – little bit later.

Example:

class ActivitycodesCollection
{
    private $list;
    private $PDO;
    private $table_name;

    public function __construct(\PDO $PDO, $table_name)
    {
        $this->PDO        = $PDO;
        $this->table_name = $table_name;
    }

    public function fetchByParameter($parameter)
    {
        $query = $this->PDO->prepare("SELECT `id` FROM `{$this->table_name}` WHERE "
                ." some_field = :parameter");
        if (!$query)
        {
            return false;
        }
        if (!($query->execute(array(':parameter'=> $parameter))))
        {
            return false;
        }

        $results = $query->fetchAll(\PDO::FETCH_ASSOC);
        if (!empty($result))
        {
            foreach ($results as $result)
            {
                $id              = $result['id'];
                $this->list[$id] = new ActivityCodes($id);
            }
        }
    }
}