Skip to main content
Tweeted twitter.com/StackSecurity/status/1073684177982316549
edited tags; edited title
Link
Anders
  • 65.8k
  • 25
  • 185
  • 226

PHP - store Store database access password in PHP class const?

Source Link

PHP - store database access password in class const

I have PHP project and I need to store MySQL access information.

I have a config.php file outside public directory and in the file I have:

class Config
{
    const host = "dbserver";
    const name = "dbname";
    const user = "dbuser";
    const pass = "dbpass";
}

Then in init.php (also outside public directory) I have helper functions and other stuff:

include "config.php";
$db = MySQLWrapper(Config::host, Config::name, Config::user, Config::pass);
//... init sessions, spl_autoloads, class maps and other stuff

Now in public www directory, I have index.php:

require_once "full path to init.php"
create page

Is this a good, safe design? Or is there any problem with class const's?

I dont want to use directly variables or array, because if someone accidentally allow error logs on server, passwords in variables could leak in error log via variables debug print.