Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My connection.php file stores the credentials to connect to the database.

    $objConnect = mysql_connect("localhost","username","password"); 
    mysql_select_db("selectDB", $objConnect);

When some of pages need to connect the database I just use <?php include("connection.php"); ?>

Is this safe?

Can hackers steal my credentials from that file?

share|improve this question
So every PHP web application does this... – rook Apr 1 '12 at 16:34
This is about as secure as you can hope to get... which isn't really particularly secure at all.. but there you go. – tylerl Apr 2 '12 at 1:44
up vote 21 down vote accepted

My recommendation: Don't store passwords in source code.

Instead, store them in a configuration file (outside of the web root), and make sure the configuration file is not publicly accessible. The reason is that you normally don't want to keep your passwords checked into the source code repository or exposed to everyone who can view files in your web root.

There is an additional risk with storing passwords in a .php file within your webroot, which is a bit obscure but can be easily avoided by placing the file outside of your web root. Consider: if you are editing connection.php using a text editor, and your connection drops while you are editing it, your editor will automatically save a copy of the connection.php file in some backup file: e.g., connection.php~ (in the same directory). Now the backup file has a different extension, so if someone tries to fetch that file, the Apache server will happily serve up a copy of the file in plaintext, revealing your database password. See 1% of CMS-Powered Sites Expose Their Database Passwords for details.

See also How do open source projects handle secure artifacts?, Open Source and how it works for secure projects?

share|improve this answer
+1 I like this answer the most. But I need to note that places outside of web root are still accessible on websites with local file inclusion vulnerabilities. Well the hacker would still need to guess the location. – SinistraD Apr 2 '12 at 3:02

It's reasonably safe. To get the content of the php file, a hacker needs to compromise your server, or you need to mis-configure it.

Still I recommend configuring mysql so that the user used by the script isn't accessible remotely, and use a different user for administrative remote access.

share|improve this answer
I wouldn't even allow remote admin - route access via phpmyadmin with appropriate controls (SSL + preferably running on a dedicated port) or even better only allow access via ssh then mysql client over filesystem socket. – symcbean Apr 2 '12 at 14:05

The problems comes if you have an php code that do possible the download of files on your server e.g'download.php?=index.php' .. if you check the google, you will see that this problem exists many sites with this vulnerability.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.