Hide Database Login Information in PHP Code

The config.php file and the .htaccess is a classic/good way to go. It's the way it is usually done with CMS or frameworks.

As pointed by JohnP, you can also store the config.php outside of the public directory, that means that it can't be accessed via HTTP. This is only a little better for security (if you don't make a mistake with your .htaccess, there is no more risks).

File structure example :

• config/ -> configuration files
• lib/ -> libraries and utils PHP files
• public/ -> all you public pages/files/images...

That way, http://www.your-site.com/ points to public/, so there's no way to access the config. But this solution implies that you can change the root web directory (or that it is already like that).

Finally, you have to remember to set this file readable and writeable by the Apache user only, not everyone (unix file access rights), so that if someone gain access to you server through another user, he can't read the file.

You normally put this in a configuration file and you access the configuration values via PHP.

Usually a project is organized such that your application code and your configuration code is outside your webroot and only your public resources (index.php, images, scripts or other resources) are available via direct access.