Question

I’ve just had an argument with a colleaque.
My index.php contains my mysql connection and therefor also the host, username, password and database name.
He claims it is a security thread for the possibility exists that the php parser may fail which would cause the webserver to return the entire file as plain text.
I however believe that IF the php parser would fail the webserver would give an internal server error to the users.

Can anyone confirm whether it is or is not a security risk?

thank you.

Answer 1

The short answer is no.

The long answer is yes, but only if:

1. your server’s been compromised, in which case people reading your php files are the least of your worries
2. you’ve misconfigured your server to parse .php files and plain text, which would be very silly indeed.

Also, if you’re using some kind of version control software, make sure your .hg or .svn or whatever folders can’t be viewed from a web browser. You’d be surprised how often that happens.

EDIT:

I would be inclined to go with some of the suggestions on here already, which is what I do in my day to day development. Have a config.php file outside of your web root folder and include this in your index.php. That way you know for sure it’s never going to be viewable. Btw, I’ve been developing in PHP for a number of years and have never had the parser fail in such a way that it’s resulted in raw PHP being displayed to an end user.

EDIT 2:

If your colleague is referring to parse errors when he talks about the PHP parser “failing” then in a live environment you should have error reporting disabled anyway.