Question

Uh oh. I’ve just realized, I think it would be extremely easy to get into my MySQL database. My webserver uses a separate PHP script to connect to the server, which includes the username and password. Correct me if I’m wrong, but couldn’t someone easily require this file in their script and then have full access to my database?

Answer 1

As others have mentioned, when another server includes your file, the server will parse it, so all they will get is the parsed file unless things are not configured correctly.

However, you should not be storing your database login credentials within your web root for this very reason. If, for example, your web root is

/home/username/public_html/

then store the file in:

/home/username/db.inc.php // change file name accordingly

Then in your script, just do

require_once('/home/username/db.inc.php');

There is no way that someone can even access that file from HTTP because it is outside your web root.