Is saving MySQL username/password in the php.ini file secure?
As long as you make sure the ini file is outside the DOCUMENT_ROOT and not world-readable, it's no less secure than any other method.
You don't have to put that info in the parameters every time. You can define the connection in a separate file (dbconnection.php
) and include that in the files that need a database connection.
It isn't secure, because you can read ini files with php method: parse_ini_file