I'm trying to make a connection to an SQL server in php. Is it safe to just put the database credentials in plaintext in the .php file? Can a user edit the php code in a a .php page and change the way an input is handled?


No, if you are talking about end user I don't think he/she can edit your php files because server didn't render php in plain text until it is being told to do so. what you can do to secure your connection.php files is to store it in a separate directory and restrict direct access to the file and directory by server config or whatever means.


The best way to enter database credentials is creating the config page(.config) and store the values in it. No the user cannot view the file unless he has administrator privilages to the sql server

  • OP: "Can a user edit the php code in a a .php page and change the way an input is handled?" Why is a config file with plaintext credentials better than a php file with plaintext credentials? – Jedi Feb 13 '17 at 5:58

If you don't want to keep database credentials in plaintext in PHP files, you could store them in environment variables on Operative System and get them using the PHP function called getenv; something like this:

$user = getenv('DB_USER');
$pass = getenv('DB_PASS');

You can add another security level in this way, the credentials will not be in plaintext on source code and Operative System hardening will help to secure them too.


I hope this information helps you.

  • This is a really bad idea. phpinfo will by default display all environment variables. While phpinfo shouldn't be displayed to users, it may well be displayed to administrators (who shouldn't be able to read out passwords either). It is also relatively easy to forget debug files calling phpinfo, and phpinfo is one of the few functions that do not require arguments (relevant for some limited code injections, eg $_GET['func']()). – tim Feb 13 '17 at 17:00
  • ok, you have to apply hardening on web server, for example, you could disable the phpinfo function, you have to add the following line on php.ini file: disable_functions = phpinfo – hmrojas.p Feb 13 '17 at 23:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.