Are there any security considerations to keep in mind when handling database connections in PHP functions?

When handling database connections in PHP functions, it is important to ensure that sensitive information such as database credentials are not exposed. One way to address this is by storing the database credentials in a separate configuration file outside of the web root directory and including this file in your PHP script. This helps prevent unauthorized access to the credentials. 

// config.php
<?php
$db_host = 'localhost';
$db_user = 'username';
$db_pass = 'password';
$db_name = 'database_name';
?>

// db_functions.php
<?php
include 'config.php';

function connect_to_db() {
    $conn = new mysqli($db_host, $db_user, $db_pass, $db_name);

    if ($conn->connect_error) {
        die("Connection failed: " . $conn->connect_error);
    }

    return $conn;
}
?>

Keywords

SQL injection PDO prepared statements database encryption secure coding practices

Related Questions