Re: Security with dbHost, dbUser, dbPassword

Satyam wrote: > .... > No problem there, the include in my DB abstraction layer includes and > calls the separate file with the function to make the connection to the > database. Though the main application source doesn't know about the > include file with the connection data in it, the DB layer include > does. In this way, I have the db include file under CVS and can > refresh it at the production server without a problem, while the include > file with the connection is separate, so that I have one for the test > machine (this one) where the server is 'localhost' which I never copy to > the production server. there are many way to skin the cat :-) > > Nevertheless, I admit that the important issue here is to have the > connection data out of the public folders, mine is just a useless > paranoid complication. Does anyone have an expression evaluator in an > application open to the public? Does anyone make a var_dump of > $_GLOBALS on error (and then forgets to strip it out on production > code)? I sure hope not. been there, done that, got the T-Shirt. :-P