I'm trying to protect an inc file who contains some data base informations , i'm using htacess to protect that file.
What i want is the following : allow only the php script to get those informations to log to the DB .
My Webroot looks like this:imgWebRoot
My .htacess code looks like this :
<files sql.cnf>
Order Allow,Deny
Deny from all
allow from indexa.php
</files>
My php file :
parse_ini_file("C:\Apache24\htdocs\sql.cnf");
echo $_SERVER[‘DB_LOGIN’]; // login
My sql.cnf File
SetEnv DB_LOGIN “login”
SetEnv DB_PASSWD “password”
SetEnv DB_DB “my_database”
SetEnv DB_HOST “127.0.0.1”
My probleme is that i can't log to the php file , and i don't understand why ?
Since you are using Apache, you can add the variables to the end of your httpd.conf file as shown below, and then access them by referencing the $_SERVER global:
SetEnv VAR_NAME strongpassword123
I do not believe the values need to be quoted. After restarting the Apache service, you will be able to reference your value using $_SERVER['VAR_NAME']. No need to parse_ini_file a separate file in the app logic.
Additionally, you should not rely on htaccess to protect credentials. If you need to store credentials in a file on the app server instead of as environment variables, they should be stored ABOVE the web root.
For example, the code below would find a file stored one level above the webroot in a directory named config.
require("$_SERVER[DOCUMENT_ROOT]/../config/config.php");