What potential pitfalls should be considered when integrating PHP into an HTML page?

One potential pitfall when integrating PHP into an HTML page is the risk of exposing sensitive information, such as database credentials, in the source code. To mitigate this risk, it is important to store sensitive information in a separate configuration file outside of the web root directory. This way, the information is not accessible to external users who may view the page source. 

// config.php
<?php
$host = 'localhost';
$username = 'root';
$password = 'password';
$database = 'dbname';
?>

// index.php
<?php
include 'config.php';

// Your PHP code here
?>

Keywords

XSS SQL injection file inclusion session management cross-site request forgery

Related Questions