Is it good practice to keep the connection strings for websites in another folder outside of the site folder?
For example, here is the htdocs structure. I am working on site3:
htdocs>
site1>
site2>
site3>
index.php
include>
database.php
site4>
Using the above, here is the database.php connection file for site3:
<?php
$host = 'xx.xxx.x.xx';
$dbname = 'mydatabase';
define ('DB_USER', 'dbusername');
define ('DB_PASSWORD', 'dbpassword');
try{
$dbc = new PDO("mysql:dbname=$dbname;host=$host", DB_USER, DB_PASSWORD);
$dbc->SetAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
}
catch(PDOException $e){
echo "Conneciton failed: " . $e->getMessage() . "<br/>";
}
?>
So what I want to do is move the connection information into another folder, called 'connections'. This is where I'll keep the actual connection info.
Here is the revised htdocs structure, with the connections directory:
htdocs>
site1>
site2>
site3>
index.php
include>
database.php
site4>
connections>
site3conn.php
Within the connections directory, here is site3conn.php:
<?php
$host = 'xx.xxx.x.xx';
$dbname = 'mydatabase';
define ('DB_USER', 'dbusername');
define ('DB_PASSWORD', 'dbpassword');
?>
So now, the database.php connection file for site3 will pull in the connection string from the connections directory. As follows:
<?php
require("D:\htdocs\connections\site3conn.php");
try{
$dbc = new PDO("mysql:dbname=$dbname;host=$host", DB_USER, DB_PASSWORD);
$dbc->SetAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
}
catch(PDOException $e){
echo "Conneciton failed: " . $e->getMessage() . "<br/>";
}
?>
Please note, both examples allow me to successfully connect to the dB. But I want to use the revised format.
I, of course, need to make sure users cannot navigate to the connections folder. Unsure how I can do that.
With that said, is this good practice? Is this more secure or less secure or neither? Is there a better way?
Appreciate your thoughts.