PEAR:DB connection parameters

Question

I just finished my first PHP site and now I have a security-related question. I used PEAR:DB for the database connection and made a separate parameter file for it. How should I hide this parameter file?

I found a guide (http://www.kitebird.com/articles/peardb.html) that says:

Another way to specify connection parameters is to put them in a separate file that you reference from your main script. ... It also enables you to move the parameter file outside of the web server's document tree, which prevents its contents from being displayed literally if the server becomes misconfigured and starts serving PHP scripts as plain text.

I have now put my file in a directory like this /include/db_parameters.inc

However, if I go to this URL, the web server shows me the contents of the file including my database username and password.

From what I've understood, I should protect this file so, that even though PHP would be served as text, nobody could read this.

What does outside of web server's document tree mean here? Put the PHP file out of public_html directory altogether deeper into the server file system? Some CHMOD?

Answer 1

You could try /include/db_parameters.inc.php also include a blank index.php/html file in that directory to prevent anyone from being able to see what is contained in the directory.

Answer 2

/include/db_parameters.inc in this case is a URI, corresponding to a real path like /var/www/include/db_parameters.inc The part before the /include is the document root. PHP stores the current document root in $_SERVER['DOCUMENT_ROOT']

In this case, to be outside the document root would be a file in a directory other than the one mentioned above.

Answer 3

Outside the document tree means the file should not be in the document root or any subfolder of the document root. You could set up a rule in an .htaccess file to prohibit access to db_parameters.inc and leave it inside the document tree, but that's probably an exercise best left for another day.