Php, security question

[Taxa]

I was wondering when designing my next project, if it is possible for users to find your database username and password? Becuase we connect to a mysql database with "mysql_connect(username etc)" is it possible for user to download the source script and then find this line of code and hack the database?

[LooieENG]

Nope, you can't download the source code for a PHP file, because it runs on the server and produces HTML output.

 

But I also have this in my .htaccess file

 

<files db.php>
order deny,allow
deny from all
</files>

 

And, if you're still a bit worried, you could place it below the web root, i.e. instead of /var/www/db.php place it under /user/yourname/db.php and call it using

 

<?php

require('/user/yourname/db.php');

?>

 

I think that's right anyway

[Taxa]

Thank you for your help!