What is the best method for securing PHP scripts that contain database passwords?
From what I've read, PHP can be revealed when an error occurs and is not caught.
Is there any way to reveal PHP by viewing source code in a browser or saving site files to a computer?
Thanks. Any information on cementing PHP scripts (except when called via AJAX) would be nice.
Is PHP encryption possible?
What is the best method for securing PHP scripts that contain database passwords?
One common approach is to put these sort of details into an own file, which is not directly accessible through the webserver, e.g. something like a config directory outside the webserver's document root. You can always include this file whereever it is needed. If for whatever reason it is possible for an attacker to return the source code of the PHP file, he will only see the include statement, but not the connection details itself.
Is there any way to reveal PHP by viewing source code in a browser or saving site files to a computer?
In theory there shouldn't. In practice there have been all sorts of exploits, which should hopefully be fixed by now. To the best of my knowledge no such vulnerability is known these days. On the other hand we are talking about PHP ;). One common mistake is for developers to upload backup files that an editor would create along with the originals, e.g. something like index.php~ or index.php.bak. These files would be returned directly by the webserver and would usually contain the details you want to protect.
Is PHP encryption possible?
It depends on what you actually want to encrypt. The configuration files? The script itself? Obviously you can encrypt basically everything, but at the end of the day it needs to be accessed and/or executed. So it would most probably be only obfuscation.
