When a PHP application establishes a database connection, it usually requires passing a login name and password. If my application uses a single, least privileged login, then PHP needs to know that login and password somewhere. What's the best way to protect that password? It seems like just writing it in PHP code is not a good idea.
![[Web front-end] Node.js quick start](https://img.php.cn/upload/course/000/000/067/662b5d34ba7c0227.png)
If you're hosted on someone else's server and don't have access to content outside of your network root, you can always put your password and/or database connection into a file and then lock that file using .htaccess:
Some people misread this as a question about how tostorepasswords in the database. That's wrong. It's about how to store the password that gives youaccess to thedatabase.
The usual solution is to move the password from the source code to the configuration file. Then leave the job of managing and protecting the configuration files to the system administrator. This way, developers don't need to know anything about production passwords, and there are no password records in source control.