What are the potential risks of hardcoding passwords directly into PHP code?

Hardcoding passwords directly into PHP code poses a security risk as it exposes the passwords in plaintext within the codebase. To mitigate this risk, it is recommended to store passwords in a separate configuration file outside of the web root directory and access them securely when needed. 

// config.php
<?php
define('DB_HOST', 'localhost');
define('DB_USER', 'username');
define('DB_PASS', 'password');
define('DB_NAME', 'database');
?>

// index.php
<?php
require_once('config.php');

// Connect to the database using the defined constants
$conn = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);

// Rest of the code
?>

Related Questions