如何在PHP中保护数据库密码配置文件？

Question

How can i secure the configure file that contain database passwords in PHP? plus i need details how to do it.

Answer 1

Put the configuration file, an included .php module, in a directory which cannot be read by the webserver. For example:

config.php:

<?php
   $db_host = "localhost";
   $db_user = "username";
   $db_password = "the literal password";
   $db_database = "default_db";
?>

Answer 2

It depends from whom you want to make it secure? 1) from some hacker? 2) from your customer who will be having access to your source code? or 3) your staff?

In all case what you can do is you can use code obfuscation to encrypt your code. ( http://en.wikipedia.org/wiki/Obfuscation_%28software%29 )

some of them which could be used are: ioncube (commercial) zend guard (commercial) http://www.intricks.com/projects/PhpCodeBuster/ (free) you can google up more of that if required.

useful posts: Is there a code obfuscator for PHP?

I am using ioncube and works well for me on all platforms (windoes+linux)