Any PHP gurus out there?

[Catch22Dem]

I have a couple of questions, so I'm curious if DU has any gurus. I work as a programmer but I have no experience with PHP.

1. Lets say I want to make a database connection. I notice I have to include the db name, db pass, etc... on the page where I want to query my database. What level of security exists for the page that now contains my database password?


2. What if all my pages talk to the same database, thus using the same connection properties. Is there some way I can set an application-wide var, or a global var for these connection properties? Or should I make a page that has the connection info and use it as an "include" on any page where I need database connectivity.

Please don't be afraid to get technical w/ me. I'm a professional. LOL ;)

[Philosophy]

1. The php code is server side

1. There is no way for the client browser to see your password - the server processes the code and outputs only html, not any code.

2. I like to hard code my database connection info in an include file in a function that just takes a SQL string and returns the results.

[Catch22Dem]

2. #2 sounds good...that's my plan

#1 works too. I know it's srv-side code, but we do have people who can access the directories where the code is stored. I wasn't worried about anyone getting to it via their browsers, rather other employees who have access to the directory and can view the code. Anyway, it's all good.

Thanks!

[ming]

3. Put config files outside your webroot

For instance, if your web pages reside at /var/www/html then put your config info in /var/www and include it. It's too easy for something to go wrong that may or may not be outside your control. At least this way, if something happens then at least your config info isn't sitting in a world readable directory. This is the same reason why you have a separate cgi-bin directory outside of your web root. As a basic rules of thumb, never put anything you don't want seen in a web accessible directory.

You may wish to peruse this site: http://www.phpadvisory.com

[Catch22Dem]

4. roger, sounds good

and thanks for the link. My boss is wanting me to investigate PHP. :shrug: Whatever, as long as he pays me ;)