PHP & MySQL connection more secure

Question

I have a small page that contains the connection data to my MySQL DB, which I include in other pages that require it. The small code is:

[connect_DB.php]
----------------
<?php

define("HOST", "localhost");
define("USER", "myUser");
define("PASSWORD", "myPasword");
define("DATABASE", "members");

$mysqli = new mysqli(HOST, USER, PASSWORD, DATABASE);

?>

A friend of mine proved to me that he can download the .PHP file, and in less than 2 min, he did. That means he got the login info for my MySQL server. And I was wondering if there existed another way of connecting with the database, without putting the password in a file, etc. He recommended me use SSL or TSL, or simply configuring the HTTPD.CONF or .HTACCES to not allow "exterior" access to the file. Is that correct or achievable?

I am actually testing this on Wamp Server (Win7), and I cannot create a .HTACCESS file because It tells me to enter a name for the file (which I am already introducing! :( ) every time I try to name it that way.

I understand that this may be a duplicate question, but believe me I read a lot of t hem but I don't understand what should I do. In advance, thank you.

Answer 1

Most likely, Your server is not setup correctly, meaning the PHP engine is not running, so its just sending or displaying the file contents back as say text/html and not being parsed by PHP. This is the only way that some tool like you mentioned in comment could possibly access the file, a tool like that would also not see the file if there was not a link to it somewhere, so perhaps you have Directory Indexes enabled to.

To test you have PHP enabled simply make a file and put in it: <?php phpinfo(); ?> if it displays your php info then im stumped, if not then its proof your server is misconfigured for PHP.

Though once fixed, it is good practice to put sensitive files outside of your web root. And not a good idea to set your values in constants as a function like get_defined_constants() will give access to the sensitive values. Just put them directly in the construct arguments.

if you want to block access to a directory where only PHP can access you make a .htaccess file with deny from all in it, this will cause the server to send a 403 Forbidden.

Answer 2

I am pretty sure that your host Provider is not parsing the PHP files, because it would not be possible to download the sources if they'd pass the interpreter.

Make sure you have PHP installed, configured and activated, contact your provider's support in case of questions. The easiest way to test this is to upload a file:

test.php

<?php phpinfo(); ?>

To protect a file it's enough to put the your database config php outside of public_html, html or htdocs directory (one of these is most likely to be your document root), where you still can include(); it via PHP.

Other solution is to protect the file via .htaccess where you put something like that inside the file and upload it to your document_root:

<Files db_config.php>
deny from all
</Files>

To add a little more security, you can protect the db_config.php by adding this on top:

if (!defined('IN_MY_PROJECT')) {
    die('forbidden');
}

and put this on top of your index.php:

define('IN_MY_PROJECT', true);