How can PHP developers protect sensitive data, such as database passwords, from unauthorized access?

To protect sensitive data like database passwords from unauthorized access, PHP developers can store these credentials in a separate configuration file outside of the web root directory. This prevents direct access to the file via a URL and reduces the risk of exposure. Additionally, developers should set appropriate file permissions to restrict access to the configuration file. 

// config.php
define('DB_HOST', 'localhost');
define('DB_USER', 'username');
define('DB_PASS', 'password');
define('DB_NAME', 'database');

// index.php
require_once('config.php');

// Database connection code using the defined constants
$conn = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);

Keywords

encryption secure coding environment variables access control password hashing

Related Questions