How can PHP developers secure sensitive data such as database connection credentials in their code?

PHP developers can secure sensitive data such as database connection credentials by storing them in a separate configuration file outside of the web root directory. This prevents direct access to the file via a URL. Developers can then include this configuration file in their PHP code to access the credentials securely. 

// config.php
<?php
define('DB_HOST', 'localhost');
define('DB_USER', 'username');
define('DB_PASS', 'password');
define('DB_NAME', 'database');
?>

// index.php
<?php
require_once('config.php');

$connection = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);
if ($connection->connect_error) {
    die("Connection failed: " . $connection->connect_error);
}
echo "Connected successfully";
?>

Keywords

encryption secure coding environment variables password hashing SQL injection

Related Questions