What potential security risks are associated with hardcoding database connection information in PHP scripts?

Hardcoding database connection information in PHP scripts can pose a security risk as it exposes sensitive information such as usernames, passwords, and database names. If an attacker gains access to the PHP script, they can easily extract this information and potentially compromise the database. To mitigate this risk, it is recommended to store database connection information in a separate configuration file outside of the web root directory. 

// config.php
<?php
$servername = "localhost";
$username = "root";
$password = "password";
$dbname = "mydatabase";
```

```php
// db_connection.php
<?php
require_once('config.php');

$conn = new mysqli($servername, $username, $password, $dbname);

if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

Keywords

security risks hardcoding database connection PHP scripts information disclosure

Related Questions