PHP is a server-side language. That means that when the requested page is sent back to the client all PHP code is parsed and "removed". As long you're the only one being able to look into your files there is no fear.
Whether you store it in (env) variables or not won't make a single difference.
There's absolutely nothing wrong with this code ;)
Edit:
When you execute an SQL query however, you need to be careful. Often, you use user input (an URL or POST data) to set certain values in a query. For example:
$sql = 'SELECT * FROM `table` WHERE `id`=' . $_GET['id'];
The $_GET['id'] variable is set in the URL (index.php?id=4).
If they change the value 4 to a bit of SQL query, they can pretty much do everything with your database. This is called SQL injection. It's truly the biggest threat of web applications using a database.
There are multiple fixes.
- Sanitize the input (make sure that the input doesn't contain SQL syntax)
- Prepare statements
Now, I'm not familiar with PostgreSQL, but apparently the PHP module has the ability to send prepared statements. This allows you to send the query with the unknown values as question marks and send the values afterwards.
$sql = 'SELECT * FROM `table` WHERE `id`=?';
// send prepared statement
$value = $_GET['id'];
// send the value
This way the database can tell that the value is no query.
Like I said, I'm not familiar with PostgreSQL, but I'm sure there are some tutorials that will guide you all the way through!
Another edit:
Because I'm a nice guy, I found how to do it! You need to use the function pg_prepare() and pg_execute(). Like this:
// This is a name to allow the database to identify the prepared statement
$queryname = 'my_query';
// Setting up our query with "empty" values
$sql = "SELECT * FROM `table` WHERE `column`='$1' AND `column`='$2'";
// Setting our values to send afterwards
$values = array(
$_GET['first_value'], // The first value that will replace $1
$_GET['second_value'] // The second value that will replace $2
);
$result = pg_prepare($connection, $queryname, $sql); // Send the query to the database
$result = pg_execute($connection, $queryname, array($value)); // Send the values
Last edit (I swear):
If you decide to put your configuration variables in an extern file, lets say configuration.php, make sure that the file ends with the .php extension. If you use a different extension, people might be able to find it and see it in plain text. If the PHP extension is used, they won't be able to see anything because like I said, the PHP is parsed and removed.
