3 ms·
I'm far from being a PHP expert, but wouldn't writing critical password/data in a file instead of directly in the source code, avoided that issue? I mean, we wo
by d0m 16y ago
I'm far from being a PHP expert, but wouldn't writing critical password/data in a file instead of directly in the source code, avoided that issue? I mean, we would have seen the code to read the file.. and not the pass?
- nbpoole 16y agoYes
- ZoFreX 16y agoIt's a symptom of PHP's slightly horrible execution model. When you request a page, a new PHP process spins up, parses it, compiles it, and executes it. There is no shared state between requests within PHP (generally - there are ways to add it) and so if configuration was stored in YAML or XML, it would have to be parsed /on every request/. Many people have made suggestions on how to trap these kinds of error... storing PHP files outside of document root is a good practice, otherwise the code can be revealed if the webserver stops interpreting PHP files for whatever reason. Any amount of testing would catch accidentally dumping the configuration file, if it isn't being parsed then nothing on the site will work. Development -> testing -> production setups aren't as common in the PHP world as they should be, though. Personally, I'm tempted to say store configuration in a .ini or YAML file or similar. If you're building a small site, it won't be a big speed issue anyway. If it becomes a speed issue, there are many ways to mitigate it, such as compiling the human-written config file to a PHP file, removing the human element that is more likely to transpose a character.