How can one hide database access credentials in PHP to prevent unauthorized access, especially in scenarios where clients have access to the server?

To hide database access credentials in PHP and prevent unauthorized access, especially in scenarios where clients have access to the server, you can store the credentials in a separate configuration file outside the web root directory. This way, clients cannot directly access the file containing the sensitive information. 

// config.php
<?php
return [
    'host' => 'localhost',
    'username' => 'your_username',
    'password' => 'your_password',
    'database' => 'your_database'
];
?>

// index.php
<?php
$config = include('config.php');

$host = $config['host'];
$username = $config['username'];
$password = $config['password'];
$database = $config['database'];

// Use the credentials to connect to the database
$conn = new mysqli($host, $username, $password, $database);

// Perform database operations
?>

Keywords

environment variables .env file security database connection access control

Related Questions