How secure is it to load sensitive data like passwords and email addresses using include() in a PHP file?

When using include() in PHP to load sensitive data like passwords and email addresses, it is not secure because the included file may be accessible to anyone who can access the server files. To solve this issue, it is recommended to store sensitive data in a separate configuration file outside of the web root directory and use PHP's require_once() function to include it in your code. 

<?php
// config.php - store sensitive data
$db_host = 'localhost';
$db_username = 'root';
$db_password = 'password123';
$db_name = 'database';

// index.php - include the config file securely
require_once('/path/to/config.php');

// Use the sensitive data here
$conn = new mysqli($db_host, $db_username, $db_password, $db_name);
?>

Keywords

security sensitive data include() PHP data protection

Related Questions