PEAR:DB connection parameters
- by Markus Ossi
I just finished my first PHP site and now I have a security-related question. I used PEAR:DB for the database connection and made a separate parameter file for it. How should I hide this parameter file?
I found a guide (http://www.kitebird.com/articles/peardb.html) that says:
Another way to specify connection
parameters is to put them in a
separate file that you reference from
your main script.
...
It also enables you
to move the parameter file outside of
the web server's document tree, which
prevents its contents from being
displayed literally if the server
becomes misconfigured and starts
serving PHP scripts as plain text.
I have now put my file in a directory like this /include/db_parameters.inc
However, if I go to this URL, the web server shows me the contents of the file including my database username and password.
From what I've understood, I should protect this file so, that even though PHP would be served as text, nobody could read this.
What does outside of web server's document tree mean here? Put the PHP file out of public_html directory altogether deeper into the server file system? Some CHMOD?
