The recommendation is predicated on the fact that PHP files will be world-readable but .htaccess files / httpd.conf won't. The author rightly points out that using encryption to hide these values doesn't help - since that means the encryption key needs to be accessible to PHP code. But storing the values in the environment only avoids some issues which are also avoidable by other means. Values in an httpd.conf file will be readable by any PHP code run on the server. Moving them into a vhost defn narrows the visibility. You can keep them as PHP code within the document root by simply prepending the filename with '.ht'.
Certainly it's good practice to maintain the tokens indepently of the bulk of the code. Since
- they will have a different lifespan than the code (i.e. may need changed independently of the code and vice versa)
- should not be exposed via code management facilities such as the version control system
- should vary depending on where the code is deployed (i.e. different tokens for test / stage / live)
However using the webserver config is only one way to achieve this - there are other valid approaches.
Regardless of which route you take, the security of the solution will come from considering all aspects - file permisssions / accessibility of the file, restrictions on DB connection, access controls at the DB