Config.php Repack Guide
<?php // old config.php $db_host = "localhost"; $db_user = "root"; $db_password = "password123"; $db_name = "my_app"; $site_url = "http://localhost/myapp"; $debug_mode = true; ?> Any page needing the database would simply write: include 'config.php'; Before we dive into security and advanced patterns, let's appreciate the core value proposition of the config.php file. 1. Maintainability Imagine you have 50 PHP files, each with a hardcoded database password. When it's time to rotate that password (as you should, regularly), you have to edit 50 files. With config.php , you edit one line in one file . 2. Portability Moving an application from a local development server (XAMPP) to a staging server (a VPS) to a production cluster (AWS) requires changing environment-specific values. A single config.php (or an environment-aware version of it) makes this trivial. 3. Separation of Concerns Business logic (how an application works) should never mix with configuration values (how the application is set up). config.php enforces this boundary. The Anatomy of a Well-Structured config.php A poorly written config file is just a list of global variables. A well-written one uses arrays, constants, and logical grouping. Let's build a robust example.
public static function load($file) { self::$settings = include $file; } }
If you have ever downloaded an open-source PHP script (like WordPress, Joomla, Laravel, or a custom CRM), dug through a legacy codebase, or started a new project from scratch, you have almost certainly encountered the unsung hero of server-side configuration: config.php . config.php
<?php // smart_config.php if (file_exists(__DIR__ . '/.development')) { define('ENV', 'development'); $db_host = 'localhost'; $debug = true; } elseif (file_exists(__DIR__ . '/.production')) { define('ENV', 'production'); $db_host = getenv('PROD_DB_HOST'); $debug = false; } ?> For object-oriented projects, treat configuration as a class.
<?php // config.php - A modern, structured approach // 1. Error Reporting (Environment specific) define('ENVIRONMENT', 'development'); // or 'production', 'staging' When it's time to rotate that password (as
// 4. Site Configuration $config['site'] = [ 'name' => 'My Awesome App', 'url' => 'https://www.myawesomeapp.com', 'timezone' => 'America/New_York' ];
<?php require_once('/home/user/includes/config.php'); ?> If you have no choice but to keep it in the web root, use .htaccess to deny access: Portability Moving an application from a local development
<Files "config.php"> Order Allow,Deny Deny from all </Files> In traditional config.php files, credentials are hardcoded in plain text inside the file . While the file itself may be protected from web access, it still lives on the server's disk. Anyone with server access (or a compromised backup) can read it.
