如何在安全的PHP脚本文件中存储用户名密码

Question

Be Clear : This question is not about password encryption/hashing to save into database.

I have developed a PHP application for a client. The application is installed on client machine with XAMPP (placed at htdocs/project_name). Client uses that application locally but the local database is synchronized with remote MYSQL database by Export Report button available on web interface.
My concern is when I store a connection string for remote database in my PHP code the username & password are visible to any guys who can hunt PHP script file and can see it. I don't even wish the client be able to view passwords used for remote connection/synchronization.
How can I achieve this?

Answer 1

You want to give user permission (login data) to connect to the database but at the same time don't give him permission (login data). The only thing that is on my mind to store login data corrupted, and in code decrypt this data with some key hardcoded in the script. This is hackable, but if the user is not programmed it is unlikely to do this

Answer 2

If you accept Kerckchoff's principle then it is impossible to provide an authentication which is available to a program run by a user without making that token available to the user. If you provided a better description of the problem, specifically the modes of operation you are trying to prevent then we might be able to provide effective solutions (eg encapsulating all data access in packages would restrict access to data for specific users).