Search code examples
phpcontent-management-systemdatabase-permissions

How do you store database credentials in typical CMS build on PHP?


What's the best practice to store database credentials in a CMS? Now I declare them in my Database singleton class:

$this->credentials = array("hostname"=>"hostname", "username"=>"username","password"=>"password", "database"=>"database");

But it's not so intuitive to search where to change them and also I'm planning to make install file for cms later.

Where and how do you store your connection preferences?


Solution

  • You can use a singleton class, as you mentioned, or something simpler.

    In all my config.inc.php files I have a standard associative array

    $config['Main_Database'] = '';
    $config['db_user'] = '';
    $config['db_pass'] = '';
    $config['db_host'] = '';
    

    The concept is the same and you're on the right track. Make it something that, as a human, makes sense to you. If someone has access to your server your screwed anyway so it's not a big deal in terms of what is more secure.

    As for the install file, I've seen many apps open the config file, adjust a few specific parts via the code and then actually re-write the file back to the server (rather than "store a setting"). It achieves the same result but done through a wizard as opposed to manually.