Re: Security with dbHost, dbUser, dbPassword

Jochem Maas wrote:

this file outside of the webroot ... I thought so too but wasn't sure if possible.

if (!defined ("config_include")) die ("Error...");

It helps me a little if I make mistakes.

granted define() is slower than creating a var - which is why some people would recommend against using it. Defines are certainly better in this case even if I don't like them very

much.

?>

I never include the closing php tag in include files to avoid stray empty lines being output - which can cause any headers that you try to send after the offending include file is included to fail. I'm used to code everything as correct as possible. ;-)

Is this save enough or are there better ways? Where should I store this

file so it isn't accessible via the net but inside scripts?

outside the webroot. what people often do is create an include dir at the same level as the webroot dir and add this directory to the include_path

ini setting. e.g. Thanks for the sample. IMO it would be a good idea if the PHP

documentation had a "common or best practice" section, which contains such samples. I know there are samples in other places yet these samples tend to be outdated. I looked through some simple authentication samples at Zend but all were from year 2001, 2002. I'd prefer just one sample but up to date. O. Wyss