1
\$\begingroup\$

Is it good practice to keep the connection strings for websites in another folder outside of the site folder?

For example, here is the htdocs structure. I am working on site3:

htdocs>
  site1>
  site2>
  site3>
     index.php
     include>
       database.php
  site4>

Using the above, here is the database.php connection file for site3:

<?php
  $host = 'xx.xxx.x.xx';
  $dbname = 'mydatabase';
  define ('DB_USER', 'dbusername');
  define ('DB_PASSWORD', 'dbpassword');

  try{
    $dbc = new PDO("mysql:dbname=$dbname;host=$host", DB_USER, DB_PASSWORD);
    $dbc->SetAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
  }
  catch(PDOException $e){
    echo "Conneciton failed: " . $e->getMessage() . "<br/>";
  }
?>

So what I want to do is move the connection information into another folder, called 'connections'. This is where I'll keep the actual connection info.

Here is the revised htdocs structure, with the connections directory:

htdocs>
  site1>
  site2>
  site3>
     index.php
     include>
       database.php
  site4>
  connections>
    site3conn.php

Within the connections directory, here is site3conn.php:

<?php
  $host = 'xx.xxx.x.xx';
  $dbname = 'mydatabase';
  define ('DB_USER', 'dbusername');
  define ('DB_PASSWORD', 'dbpassword');
?>

So now, the database.php connection file for site3 will pull in the connection string from the connections directory. As follows:

<?php
  require("D:\htdocs\connections\site3conn.php");

  try{
    $dbc = new PDO("mysql:dbname=$dbname;host=$host", DB_USER, DB_PASSWORD);
    $dbc->SetAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
  }
  catch(PDOException $e){
    echo "Conneciton failed: " . $e->getMessage() . "<br/>";
  }
?>

Please note, both examples allow me to successfully connect to the dB. But I want to use the revised format.

I, of course, need to make sure users cannot navigate to the connections folder. Unsure how I can do that.

With that said, is this good practice? Is this more secure or less secure or neither? Is there a better way?

Appreciate your thoughts.

\$\endgroup\$
8
  • \$\begingroup\$ Whether clients can navigate to the connections folder is matter of web server setup, no matter where the folder is in the directory tree. Putting it outside a project folder does not make much sense though, unless multiple sites share a connection (credentials). The common approach is to have a project folder and in it a configs folder and public folder and only the public folder is configured to be accessible through web server. The public folder should contain only index.php and static assets like js, css, images etc. \$\endgroup\$
    – slepic
    Nov 19, 2020 at 5:47
  • \$\begingroup\$ All configs, php sources, etc are then outside the public folder, thus inaccessible from web, but still inside project folder keeping it centralized... \$\endgroup\$
    – slepic
    Nov 19, 2020 at 5:48
  • \$\begingroup\$ PS i am posting it as comment because I haven't really reviewed your code. Your questions don't really fit the scope of this site. I'm not voting to close either because there is some reviewable code, but I don't think that's your focus. You seem to be concerned more about design than the actual code... \$\endgroup\$
    – slepic
    Nov 19, 2020 at 5:54
  • \$\begingroup\$ Pretty much all commentators gave good advice here. If your project is manageable I mean won't be a huge MVC type of application then you can stick to your option. But don't do stuff like this: require("D:\htdocs\connections\site3conn.php"); you're hardcoding the path to the file which only resides in your computer, now image what's gonna happen if you upload this code to a different server, you need to use relative path. \$\endgroup\$
    – Erasus
    Nov 19, 2020 at 12:01
  • \$\begingroup\$ @Erasus - I was using a path inside the site dB connection file that looked like this: include("../../connections/site3conn.php") , but I kept getting an error that read "system cannot find path specified. When I switched over to the absolute path, I no longer got the error. \$\endgroup\$ Nov 19, 2020 at 14:04

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.