What are the best practices for securely storing sensitive information such as mail server credentials in PHP scripts?

Sensitive information such as mail server credentials should never be hard-coded directly into PHP scripts as this can pose a security risk if the code is exposed. Instead, it is recommended to store these credentials in a separate configuration file outside of the web root directory and include this file in your PHP script. This way, the credentials are kept secure and can be easily updated without modifying the code.

// config.php
<?php
define('MAIL_SERVER', 'mail.example.com');
define('MAIL_USERNAME', 'username');
define('MAIL_PASSWORD', 'password');
define('MAIL_PORT', 587);
?>

// index.php
<?php
require_once('config.php');

// Use the defined constants to connect to the mail server
$server = MAIL_SERVER;
$username = MAIL_USERNAME;
$password = MAIL_PASSWORD;
$port = MAIL_PORT;

// Your mail server connection code here
?>