safest place to store php values for msql_connect?

Question

Were is the safest place to store my values which will be used in mysql_connect also what is the safest way to call these variable would be better using a require , include or something else ?

thanks :)

Answer 1

The best place to store it IMO is in a PHP file (whether you use require or include to fetch it doesn't matter) outside the web root, i.e. not directly accessible in the browser.

<?php

  $db_server = "xyz";
  $db_user = "def";
  $db_password = "abc";

?>

If there is no access outside the web root

@Yacoby wrote this down in his answer. He deleted it since, but it definitely deserves mention.

There are foolish hosting providers who don't allow access outside the web root. In that case, you put the config file in a directory in your web site and protect it using a .htaccess file containing Deny from All. This works on most hosting packacges. Make sure you test it though, you should get a 403 Forbidden when trying to access that file.