Where do you save user,password for connect database

PHP
1

where do you save username,password,database name?
for me i create all data in file dbc.php
and include this file for connect
in file dbc.php
and define username,password,host,database name

what do you think about it?

2

possible they can read my PHP file on server?
for username we define -> $987654123TgUiaLosPXlsdsdsdsedw=root;
for password we define -> $987654123TgUiaLosPXlsdsdsdsesdsdw=12345;
for host we define -> $987654123TgUiaLosPXlsdsdsdsedwdsfse=localhost;
if Yes: what should do?
if NO: we only create configweb.php and inside define all data,for use all file and what should we set permission file?

3

Has anyone tried defining SELinux policy (or some other technique) to define which php files can include what files?

4

Defining them as global variables is not a good idea, because then you’re leaving the gates wide open for ANY code to gain access to that information.

Commonly you should store the username and password in a configuration file that is outside of the web accessible structure. That way any passwords are not available from your source control, and the configuration file can be appropriately secured (and configured) by the system administrators.

5

I prefer an XML file above the site root.


<?xml version="1.0"?>
<config>
		<db>
			<pass>pass</pass>
			<user>user</user>
			<host>host</host>
			<db>db</db>
		</db>
</config>
6

This is why it’s stored outside of the web structure, and/or the system administrator set the permissions for the file so that it’s not publicly accessible.

7

But I’m not sure they can open my file in on server?
or set permission?