security - The right way to create a config.php -

security - The right way to create a config.php -

at moment placing config.php file in include folder on apache server, gives me easy access file, having write directory path. assume thought since secure , not reachable outside public root folder.

i never told how create config.php file improvised, seems may have been done wrong way.. (not secure now). began search tutorials on how build these config files right way, each , every tutorial had own way it.. did using arrays.. did defining configuration variables.. others using class.. there may not right way, want secure , functional scheme work, , don't care how advanced going be..

this current config file.. should see not secure in way, cause might able echo variables , read connection.

<? $main_host = 'db01.server.local'; // there may db02, db03 etc. $main_psw = '********'; $main_host_end = '.server.local'; // makes possible me connect different datastore knowing subdomain. // *** users *** // $w_user = 'w_user'; $xr_user = 'xr_user'; $r_user = 'r_user'; $w_server = 'w_server'; $w_db_admin = 'dbw_admin'; // *** databases *** // $db_accounts = 'accounts'; $db_server = 'server_setup'; // *** db accounts *** // seek { $w_accounts = new pdo("mysql:host=$main_host;dbname=$db_accounts", $w_user, $main_psw); $w_accounts->setattribute(pdo::attr_errmode, pdo::errmode_exception); } catch(pdoexception $e) { echo 'error: ' . $e->getmessage(); } seek { $r_accounts = new pdo("mysql:host=$main_host;dbname=$db_accounts", $r_user, $main_psw); $r_accounts->setattribute(pdo::attr_errmode, pdo::errmode_exception); } catch(pdoexception $e) { echo 'error: ' . $e->getmessage(); } // *** db server setup *** // seek { $w_server = new pdo("mysql:host=$main_host;dbname=$db_server", $w_user, $main_psw); $w_server->setattribute(pdo::attr_errmode, pdo::errmode_exception); } catch(pdoexception $e) { echo 'error: ' . $e->getmessage(); } seek { $r_server = new pdo("mysql:host=$main_host;dbname=$db_server", $r_user, $main_psw); $r_server->setattribute(pdo::attr_errmode, pdo::errmode_exception); } catch(pdoexception $e) { echo 'error: ' . $e->getmessage(); } ?>

so.. inquire question directly. right way create config.php file? hope other people find useful know.

edit should mension might not all.. may have farther connections make.. not accounts , server_setup

first, never ever echo exception messages in production, instead set them readable logfile.

if @ many mvc frameworks, php config files consist of array, returned @ end of file.

limiting access these config files can done via .htaccess "deny all"

php security include config