Search code examples
phppasswords

How to hide password in configuration files


Is there a way to hide my password for database access in my config.php configuration file ?

What is the best way to do this ?

I want to hide to visitors and hosting's admin :)


Solution

  • You can't generally hide them because at some point they have to be read by the application using it in run-time. The better bet is to keep them secure so they don't have a chance to be readable by anyone except you (or authorized personnel).

    For example, your config.php should NOT be in a public or html directory that's web accessible. If I go to website.com/config.php, I should not see the file produced (even if it would typically be blank). This is because sometimes PHP code is exposed when a configuration setting is off, and this could reveal the code that sets the password you're trying to keep private.