Where to put the database sensitive information [duplicate]

Question

Possible Duplicate:
How to secure database passwords in PHP?

Recently I was given a website project which was supposed to be done in PHP but I don't have much experience in PHP. Anyway, it is up and running but there is a big room to improve. The one thing that I am not feeling well is the way I am dealing with database: I put the database connection information in a separate db.php file and include it where needed. But I remember seeing PHP source files returned by the server many a time.

So now my question is: what is a better or the best way / place to put database sensitive data?

By the way, how NOT to let PHP show error messages on web pages when things are gone wrong? A custom error page or settings somewhere in php.ini? Thanks!

Note: I am using PHP in it's old flavor not object-oriented way. But I am open to object-oriented or MVC way if there are better approaches that way to prepare for future projects

Answer 1

I don't know if this is what you are looking for:
You can put your sensitive data in your db.php, but outside the web root directory (public_html or www).

For example, you could have a directory called config which is a sibling of your web root directory, and store your db.php file there.

You can include your db.php file like this:

require_once('../config/db.php');

I hope this helps.