note 111116 deleted from function.parse-ini-file by danbrown

Note Submitter: cory at xison dot ca ---- Just a note to the two before me, regarding a more secure .ini file by enclosing the data in PHP. First of all, best practices would be to store the file outside of your htdocs directory. For example, if your htdocs path is "/www/mywebsite.com/htdocs/", perhaps create a folder called "/www/mywebsite.com/private/" and place the config files in the private folders. This is not always possible with shared hosting, and I understand that. Another option is to use .htaccess or similar to make the folder the file is hidden in inaccessible to the web server. .htaccess does not protect against malicious file include injections, though. If you insist on enclosing your ini file settings in a PHP wrapper, consider the following (ignore my opening and closing statements.. it's for easier readability): --- begin settings.ini.php --- ; Nothing to see here. :-) <?php exit();?> [category] name="value" Move along, please. [category2] name2="value2" --- end settings.ini.php --- The reason for this is PHP will end after the first line. It also makes it much easier if your program is also generating the file and saving it to disk, as you only have to program in the first line instead of making it more complex than it needs to be. I realize this does not protect against accidental (or malicious) fopen()/fread()/file_get_contents()/etc. but it is up to you to ensure those functions are not fetching data based on user input. :-)