Question

Where is the most secure place to put MySQL database connection details when connecting via a PHP script?

$connection = mysql_connect($hostname, $username, $password);
if (!$connection) {die('Could not connect: ' . mysql_error());}
mysql_select_db($database, $connection);

I know it’s not a good idea to put them directly in the script that is querying the database. However, some say that you should put the connection details in a separate PHP script and include that script to connect.

Is there a more secure place to put the connection details?

Answer 1

The usual practice is to put them into a separate file, and put that outside the web root. See this answer for details.