Define database details in index.php I've got a multi-environment setup similar to the following, and thinking about adding database details to the index.php. In this way, I can pretty much just edit the index.php when creating new websites - staying out of app/config.

switch ($_SERVER['SERVER_NAME']) {
    case 'local.craft.dev':
        define('CRAFT_ENVIRONMENT', 'local');
        define('CRAFT_DB_USER', 'root');
        define('CRAFT_DB_PASSWORD', 'craftycraft');
        define('CRAFT_DB_DATABASE', 'local');
        break;
    case 'staging.com':
        define('CRAFT_ENVIRONMENT', 'staging');
        break;
    default:
        define('CRAFT_ENVIRONMENT', 'production');
        break;
}


Would there any potential security issues with this? I imagine being in the web root might be risky - but would having this information in db.php a level up really made a difference to a hacker?

Would like to hear your thoughts!
As long as Apache and PHP are working like they’re supposed to, this is fine. Files that end in .php should always get processed by PHP before they’re served to the client.

Here are the risks:


If PHP is ever disabled, or the server is misconfigured so .php doesn’t get processed by PHP, then Apache will start serving that file directly, exposing all of your code (and in this case, your DB credentials).
Every PHP file that gets loaded after index.php will be able to see those constants, and potentially echo them out. (Most likely this would be your own doing, e.g. you might be echoing out everything from get_defined_constants() while trying to debug something.)


If you can live with those, go for it. Personally, I’d say it’s just not worth it.