Skip to content
PHP Logo

What are best practices for securely handling database credentials in PHP scripts, especially when using system commands like mysqldump?

When handling database credentials in PHP scripts, it is crucial to avoid hardcoding them directly in the script to prevent unauthorized access. Instead, store the credentials in a separate configuration file outside of the web root and include it in your PHP script. Additionally, consider using environment variables or encryption to further secure the credentials. When using system commands like mysqldump, pass the credentials securely as command-line arguments rather than embedding them directly in the command.

php 
<?php
// Include the configuration file with database credentials
require_once('/path/to/config.php');

// Use the credentials from the configuration file
$host = $config['db_host'];
$username = $config['db_username'];
$password = $config['db_password'];
$database = $config['db_name'];

// Construct the mysqldump command with the credentials
$command = "mysqldump -h $host -u $username -p'$password' $database > backup.sql";

// Execute the command securely
exec($command);
?>

Related questions