Storing settings, to edit later, in PHP

Question

I am writing a PHP application that will have the ability to edit settings through a web interface. I didn't mean for the user (and actually, it will only be admins) to be able to load the file up in a text editor, but rather, they make a change using a form, and that will change the settings file (and do other things as well).

At this stage in the development, settings are stored in a PHP file, for example:

define ('UPLOAD_DIR','uploads/');
define ('DISPLAY_NUM',true);
$names = array('a' => 'b','c'=>'d','e'=>'f');

However, parsing arrays (and they get more complicated (i.e multilevel nested) than the above), doesn't seem so fun. And because specific settings can be added and removed, reading the entire file, and then writing out all the settings again, doesn't seem fun either.

What are the advantages and disadvantages to using the following formats? (And any others that I missed out):

• Custom XML
• INI (able to use parse_ini_file)

(Using a database is not suitable due to the requirements for the project. I understand in many situations a database would be prefered, just not in this case.)

If you were unable to use a database, and had to store settings that could be edited using a web interface, what would you do?

(Note: This is a different question to this one, where settings can't be changed, it's PHP file all the way. And yes, the setup does currently write out a PHP file with the correct settings.)

Answer 1

I wouldn't like the idea of someone having direct access over settings, so it's important to provide an interface to act as a buffer, preventing deliberate attacks and ensuring clean output.

With that in mind the choice of server side format is not important at all, as long as you can interface with it correctly all other problems can be worked around.

Answer 2

I'd recommend a custom XML file, that way your config will scale well and you can use PHP XML libraries to access it.

A quick example:

<myconfig>
  <define>
    <name>UPLOAD_DIR</name>
    <value>uploads/</value>
  </define>
  <define>
    <name>DISPLAY_NUM</name>
    <value>true</value>
  </define>
  <array id="names">
    <value index="a">b</value>
    <value index="c">d</value>
    <value index="e">f</value>
  </array>
</myconfig>

Answer 3

If you're not committed to using XML, you may like to consider YAML. I've only used it with Ruby, but a quick Google suggests there are a few options for PHP support. TBF, the links there include some arguments against using YAML with PHP, but YMMV.

Answer 4

PHP has built in functions for editing and parsing INI files, which use a plain-text format to store program settings.

• http://us.php.net/manual/en/function.parse-ini-file.php
• http://us.php.net/manual/en/function.parse-ini-string.php

Answer 5

I have used a two step approach. The variables and their names are stored in the database with an interface that gives the user the ability to change them. When they change them a file gets saved onto the server and then referenced throught out the application (The changes are alos saved back to the DB). Makes updating easy and makes backups simple - no need to backup the files, just backup the database. The resulting files are just .inc files that are in the format $variableName = 'variablevalue';

Answer 6

OK, I didn't get any sort of answer I was looking for. Here's the sort of thing I was expecting.

INI

• Storing settings in an INI file might be appropriate for simple settings which you want the user to edit by hand.
• However, creating complex arrays is not easy, and would require some mental acrobatics to understand which heading is at which level of the array.
• Reserved words, which must not be used anywhere in the file, include: yes, no, true, and false, this might be problematic.
• Constants can be used in the file.
• No built in method of writing out INI files.

XML

• Can use the SimpleXML Extension, which "provides a very simple and easily usable toolset" to turn XML into an object that can then be processed using the normal methods.
• Allows the use of very complex arrays.
• Possible to edit by hand, if required.
• Can use external tools to verify the validity of the file.
• Many many XML processors available for PHP.

YAML

• http://yaml.org/
• http://www.techyouruniverse.com/software/dont-use-yaml-for-php-use-parse%5Fini%5Ffile

Remember: no database. Requires being able to use complex arrays.

Answer 7

And why not plain php?

configure-form.php

form method=POST action='configure.php',

input fields ex. name='upload' value='<?php echo UPLOAD; ?>'

a configure.php file:

$myfile = 'sets.php';
$fh = fopen( $myfile, 'w' );
$upload = '"/upload/"';
$txt = "define( UPLOAD, '" . $_POST['upload'] . "' );";
fwrite( $fh, $txt );
fclose( $fh );

and there you have it. Simple php which creates configure file for you.