Best Practices for creating a PHP INI/CONFIG file and keep it secure

Question

I always used a normal PHP file and just defined the variables in that file, but is this considered best practice?

Example:

<?php

define('DB_PASS', 'p@ssw0rd');

?>

Answer 1

Naming your PHP file something that begins with .ht (for instance .htconfig.inc.php) also helps, since Apache usually has a rule never to serve any files that are named .ht*. But placing your file outside of the document root is even better.