I've got a multi-environment setup similar to the following, and thinking about adding database details to the index.php. In this way, I can pretty much just edit the index.php when creating new websites - staying out of app/config.

switch ($_SERVER['SERVER_NAME']) {
    case 'local.craft.dev':
        define('CRAFT_ENVIRONMENT', 'local');
        define('CRAFT_DB_USER', 'root');
        define('CRAFT_DB_PASSWORD', 'craftycraft');
        define('CRAFT_DB_DATABASE', 'local');
    case 'staging.com':
        define('CRAFT_ENVIRONMENT', 'staging');
        define('CRAFT_ENVIRONMENT', 'production');

Would there any potential security issues with this? I imagine being in the web root might be risky - but would having this information in db.php a level up really made a difference to a hacker?

Would like to hear your thoughts!

  • Before we go any further, I think it might be necessary for you to explain what you're trying to accomplish by staying out of 'app/config'. – Wes Rice Oct 28 '14 at 13:16
  • Currently only need to edit index.php (for domain names) and db.php for database connections for each new install. While yes - it's only two files to edit, just wanted to be able to define this stuff in one place. Call me lazy if you will! – crawf Oct 28 '14 at 13:18
  • 1
    I'm no security expert by any means, but my understanding is that being outside of web root makes a huge difference. – Douglas McDonald Oct 28 '14 at 13:34
  • And that's what I was thinking - certainly don't want to sacrifice security for convenience. Can't hurt to ask :) – crawf Oct 28 '14 at 13:37
  • 1
    I'd steer away from doing this in index.php simply because there is a documented way of doing this in 'app/config'. If you think of bringing more people into this project, it would be an irregular practice that wouldn't necessarily be clearly evident, which can cause confusion and problems. If you're the only developer, that is fine, but this is not a practice I'd recommend to anyone else reading this issue. – Wes Rice Oct 28 '14 at 21:58

As long as Apache and PHP are working like they’re supposed to, this is fine. Files that end in .php should always get processed by PHP before they’re served to the client.

Here are the risks:

  • If PHP is ever disabled, or the server is misconfigured so .php doesn’t get processed by PHP, then Apache will start serving that file directly, exposing all of your code (and in this case, your DB credentials).
  • Every PHP file that gets loaded after index.php will be able to see those constants, and potentially echo them out. (Most likely this would be your own doing, e.g. you might be echoing out everything from get_defined_constants() while trying to debug something.)

If you can live with those, go for it. Personally, I’d say it’s just not worth it.

  • Thanks Brandon for your comments, I'll be following your advise :) – crawf Oct 28 '14 at 21:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.