Many of the code snippets we have shown for accessing databases have included the database name, username, and user password in plain text, as follows:
$conn = @new mysqli("localhost", "bob", "secret", "somedb");
While this is convenient, it is slightly insecure because somebody could have immediate access to our database with the full permissions that the user "bob" has if he got his hands on our .php file.
It would be better to put the username and password in a file that is not in the document root of the web application and include it in our script, as follows:
We should think about doing the same thing for other sensitive data.
