为什么将MySQL凭据放在www目录之外？[重复]-WhyputMySQLcredentialsoutsideofwwwdirectory?[duplicate]

8  

It's a preventative measure. If someone accidently disables php evaluation in your apache server or changes an apache setting in an .htaccess file, the file could be served up like any plain text file. Or, if you accidently forget a php start tag, it would be redenerd like plain text. Not that you'd make such a dumb mistake, but maybe a future newbie working on your code might make a mistake.

这是一种预防措施。如果有人意外地在您的apache服务器中禁用了php评估或更改.htaccess文件中的apache设置，则该文件可以像任何纯文本文件一样提供。或者，如果您意外忘记了php开始标记，它将像纯文本一样重新获得。并不是说你犯了这么愚蠢的错误，但未来的新手可能会犯错误。

Why leave a possible vector open when you can prevent it from ever being possible? Just take the advice of others who have shot their own foot (or like me, shot both feet and a hand) and move the credentials outside your docroot.

为什么在可以阻止它可能的情况下保留可能的向量？只需听取其他人的建议（或者像我一样，用双脚和一只手射击）并将凭证移到你的docroot之外。

5  

Because, to a certain extent, nothing under the web root is secure. It's available on the Internet, which makes it inherently insecure.

因为，在某种程度上，Web根目录下的任何内容都不安全。它可以在互联网上使用，这使它本身就不安全。

There always exists the possibility that a misconfigured server may one day output the contents of any PHP file, rather than send it to PHP to be interpreted. There are also too many people out there trying to get into your database any way they can... some of them just for fun.

错误配置的服务器总有可能有一天输出任何PHP文件的内容，而不是将其发送给PHP进行解释。还有太多的人试图以任何方式进入你的数据库...其中一些只是为了好玩。

In any given situation, you should always use the most secure methods available. It's a good habit to get into.

在任何给定的情况下，您应始终使用最安全的方法。进入是一个很好的习惯。

Also, you should never use the root password in your web application. Create a special user with minimal privileges.

此外，您永远不应在Web应用程序中使用root密码。创建具有最小权限的特殊用户。

For PHP I always use an .ini file to store sensitive configurations...

对于PHP，我总是使用.ini文件来存储敏感配置...

2  

Because what's inside www directory (ie the root of your website) can be potentially accessible from the internet.

因为可以从互联网上访问www目录中的内容（即您网站的根目录）。

That means that if you put your credentials in here, maybe someone will be able to access them, and to connect directly to your DB.

这意味着如果您将凭据放在此处，也许有人可以访问它们，并直接连接到您的数据库。

Putting your credentials outside of this directory guarantees that it won't be accessible this way.

将您的凭据放在此目录之外可确保以这种方式无法访问它。