PHP storing db credentials in session

Question

Using PHP, is it alright to store database credentials in $_SESSION? I am looking for a way to avoid including config files every time I need to use config vars.

there's nothing wrong in having a config file included all the time! — Jeff
– Jeff, Commented Aug 10, 2017 at 17:50
It's not really a good idea to use $_SESSION for this, because it seems like it would be slower — GrumpyCrouton
– GrumpyCrouton, Commented Aug 10, 2017 at 17:51
Maybe Jeff haha. Using session vars just seemed easier to me. But maybe not :P — Zach Abrams
– Zach Abrams, Commented Aug 10, 2017 at 17:52
@ZachAbrams including a config file is really easy. Most config files are near the root of your project, you can include them on any page by doing include_once $_SERVER["DOCUMENT_ROOT"].'/path/to/config', the path will start from the root folder of your project. — GrumpyCrouton
– GrumpyCrouton, Commented Aug 10, 2017 at 17:53

GrumpyCrouton · Accepted Answer · 2017-08-10 18:19:09Z

1

I would suggest sticking with the config file, as it allows changes in real time, if you change the config then this data will change instantly for any users that are online, where sessions would have to be set again every time it's changed. Always including a config may be easier than you think.

You can include a file using a path from your directory root, like this:

<?php 
   include_once $_SERVER['DOCUMENT_ROOT']."/path/to/config.php";
?>

Where the path should be from your document root, basically from the root of your project. A lot of the time people keep this file in their root, so if your config file is at http://example.com/config.php

using this include will load it from any php file in your project.

<?php 
   include_once $_SERVER['DOCUMENT_ROOT']."/config.php";
?>

Also, as Qirel mentioned:

The config should be stored outside the public folders - only accessible by the server (and not directly in the browser).

edited Aug 10, 2017 at 18:19

answered Aug 10, 2017 at 17:58

GrumpyCrouton

8,6357 gold badges37 silver badges81 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Qirel Over a year ago

Just a note, include isn't a function, so the parenthesis isn't needed. Also the config should be stored outside the public folders - only accessible by the server (and not directly in the browser).

Collectives™ on Stack Overflow

PHP storing db credentials in session

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related