Securely Storing PHP Configuration Settings

In a typical PHP application, you’ll need to connect to a database, send an email use an API and so on doing things like this requires credentials like a username and password are an API. Key secret values like these should not be stored. With your PHP code take this code, for example, here we have four variables containing the connection details for connecting to a database, these values are hard coded in this file. If we check this file into source code control, for example, a biorepository, then these values can be seen by anyone who has access to this source code.

This could be any developer in your organization. Some of which shouldn’t have access to secret data like this if. This is open source. Then anyone can see them also when this code is moved to a different server for example. If you’re developing locally then deploying your code to production, then you’ll need to change this file, the same is true for any file that contains credentials like this so instead of storing values like this in. Here, let’s store them somewhere, else let’s create a new file called config.php. This isa PHP file. So, let’s start with the PHP opening tag defining PHP constants might seem like a good choice, as these will be available globally so.

Let’s use the defined function to define constant for each database. Connection value back in the original script, we can now remove these hard-coded variables and require the file that we just added then instead of the individual variables that we were using before we can use the constants. We just defined the advantage of doing it like thesis that it’s simple and quick absit’s.

Just PHP code that doesn’t require any additional passing the disadvantages of using constants though is that you’re polluting the global namespace which can cause compatibility problems if any Library defines a constant with the same name, so instead of using constants, let’s create a variable containing, an associative array with an element with, an index of Database, it’s typical to do something like this, so that this array can contain configuration settings for different things: like the database, email, server, API keys and so on this will in turn, contain an associative array with elements for each of the database credentials.

Then back in the index script instead, of the constants. We can use the values from the config variable that’s defined in the other file. The main downside of using a PHP script.

For configuration settings is that you might be tempted to add conditional statements or other code in here that returns different values, based on the environment, configuration settings should just be simple values an alternative to. This is to use a different format, forth config file, for example, in any files. Let’s create a new file called consignees, this isn’t PHP code, we don’t need the PHP opening tag.

The file format is the same as Theone used by php.ne, so we can define a section inside square brackets and each setting separated from its value by an equal sign back in the main script. We can use the built-inpass any file function to load and pass the contents of this file. If we pass in true as the second argument, it will return an associative array with a separate element for each section. This will result in the config variable containing the same array as before. So, we don’t need to change the code below the advantage of a format like this. Is that you can’t add PHP code to it, and it stays nice and simple other formats you could use are Json, which would look. Like this are yawl, which would look like this like any files.

These are formats that you can’t add executable code to, so they remain as just settings, though, does require a third-party library in order to pass the files. Another popular option, into store the configuration settings in environment variables environment variables are values stored within the operating system that the application can access. This is one of the techniques used to make your application comply with the 12 Factor App methodology.

These can be set in the operating system itself, using the supplied configuration tools, for example like this in Windows. These canal so be set in the web. Server configuration for example in Apache using the set end of directive. We can then retrieve these values in PHP using the get end function instead of setting these variables directriz the operating system or the web server configuration. It’s common to store these in a configuration file called a Dot N file so.

Let’s create a new file whose name starts withal DOT, followed by Envi in here we can Define the settings that we need again.

This is not PHP code just, simple Syntax, for defining values to read this file. We need a third-party package, one of the most popular packages to do this is PHP dot.

End let’s install this using composer on the command line, so, instead of reading the dot any file to use the package first, let’s require composer’s autoloader then to load the dot end file. We just created. We call the create immutable method, on the dot, end class in the dot end of namespace passing in the folder, where the dot end file is then. We call the load method on the object that this returns to load the file, this loads, the values from this file into the environment. So, the get end function will now return.

These values we can also use the end.

Super Global as this is also populated with these values.

Now that we’re stirring the sensitive values Ina separate file, this file would be excluded from source code control for example. If you’re using git, your Gi ignore file would contain the dot end file name now that this file isn’t part of the source. Code we, don’t know what values should be placed in Ita common technique to overcome.

This is to create an example’s file that is stored, with the source code.

Then, whenever someone getas copy of the source code, they can create adopt end file based on this example. You’d also store this file outside of the Webroot, so it can’t be accessed from a web browser so using dot end files to store sensitive credentials is today’s current best practice and is what’s recommended.

https://www.easycash4ads.com/autoplay.aspx?ref=yoseskba64z

https://hop.clickbank.net/?affiliate=aff61bz25k&vendor=manifmagic&pid=article6