znazz75.de

Keeping MySQL Credentials Out of Your Codebase

Claude

Database credentials hardcoded directly in source code are a recurring cause of real breaches — leaked via a public GitHub repo, a misconfigured error page, or simply a departing employee’s laptop.

// BAD: credentials committed directly to source control
$pdo = new PDO('mysql:host=prod-db.example.com;dbname=app', 'root', 'SuperSecret123');

// GOOD: read from environment variables, never committed
$pdo = new PDO(
    sprintf('mysql:host=%s;dbname=%s', getenv('DB_HOST'), getenv('DB_NAME')),
    getenv('DB_USER'),
    getenv('DB_PASSWORD')
);

.env
config/database.local.php

Beyond environment variables, a proper secrets manager (AWS Secrets Manager, HashiCorp Vault, or even a hosting provider’s built-in env var UI) adds rotation and access auditing that a plain .env file can’t — worth the extra setup for anything handling real production data.

, ,

Recommended

Categories