-2

What is the best method for securing PHP scripts that contain database passwords?

From what I've read, PHP can be revealed when an error occurs and is not caught.

Is there any way to reveal PHP by viewing source code in a browser or saving site files to a computer?

Thanks. Any information on cementing PHP scripts (except when called via AJAX) would be nice.

Is PHP encryption possible?

closed as too broad by Eric G, Xander, TildalWave, Steve, GdD Mar 27 '14 at 9:59

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Don't put sensitive data like passwords and API keys directly in your source tree. Stuff like that shouldn't ever make its way into revision control. – Stephen Touset Mar 26 '14 at 20:16
5

What is the best method for securing PHP scripts that contain database passwords?

One common approach is to put these sort of details into an own file, which is not directly accessible through the webserver, e.g. something like a config directory outside the webserver's document root. You can always include this file whereever it is needed. If for whatever reason it is possible for an attacker to return the source code of the PHP file, he will only see the include statement, but not the connection details itself.

Is there any way to reveal PHP by viewing source code in a browser or saving site files to a computer?

In theory there shouldn't. In practice there have been all sorts of exploits, which should hopefully be fixed by now. To the best of my knowledge no such vulnerability is known these days. On the other hand we are talking about PHP ;). One common mistake is for developers to upload backup files that an editor would create along with the originals, e.g. something like index.php~ or index.php.bak. These files would be returned directly by the webserver and would usually contain the details you want to protect.

Is PHP encryption possible?

It depends on what you actually want to encrypt. The configuration files? The script itself? Obviously you can encrypt basically everything, but at the end of the day it needs to be accessed and/or executed. So it would most probably be only obfuscation.

Not the answer you're looking for? Browse other questions tagged or ask your own question.