Seems to be the general practice these days is to store secrets (e.g., DB, API credentials) in a
.ENV file then load it to
$_SERVER automatically. This popular library does that and it's even encouraged as best practice. This library takes it a step further and encrypts the value inside the
They say the whole purpose is to easily manage dev/production configs and to minimize config files being pushed to version control. On top of "never store sensitive credentials in your code".
One glaring issue about this is a simple injection of
print_r($_ENV) in your code will reveal everything. Or, if you forgot to delete
phpinfo.php, all is lost! There are also other ways it could leak (e.g., logs).
I'm quite baffled that this practice is prevalent or maybe I'm just missing something.
Is there anything particularly wrong with the good old
config.php stored outside document root? I mean you could put that in git ignore too and it's not going to be part of your code at all. You can even encrypt it too. Why use
Here's an article that agrees to my sentiments