Config.php

When working with config.php, follow these best practices:

  • Use environment variables:
  • Use a configuration management system:

    • If index.php includes config.php, and config.php tries to include another file using a relative path, you'll get "file not found." Always use __DIR__ or absolute paths.

    // Bad
include 'another_config.php';

    // Good
include DIR . '/another_config.php';

    The config.php file is a crucial configuration file used in various web applications, particularly in PHP-based projects. It serves as a central location for storing sensitive information, such as database credentials, API keys, and other environment-specific settings.

    For object-oriented projects, treat configuration as a class.

    <?php
// Config/Config.php
namespace App\Config;

    class Config 
private static $settings = []; config.php
    

    public static function get($key, $default = null) 
    return self::$settings[$key] ?? $default;
public static function load($file) 
    self::$settings = include $file;

    

    

    // Load it
Config::load(DIR . '/settings.php');
$dbPassword = Config::get('db.password');

    In traditional config.php files, credentials are hardcoded in plain text inside the file. While the file itself may be protected from web access, it still lives on the server's disk. Anyone with server access (or a compromised backup) can read it.

    Modern PHP development (especially with frameworks like Laravel, Symfony, or Laminas) has largely moved toward environment variables using a .env file.

    Let’s address the elephant in the room. The single most dangerous mistake beginner developers make is placing config.php inside the web root (e.g., public_html, www, or htdocs). When working with config

    Business logic (how an application works) should never mix with configuration values (how the application is set up). config.php enforces this boundary.