title: PHP/Server Side: How to properly conceal database credentials files
body: <p>I've had lots of problems concealing database credentials needed for PHP classes. None of the "solutions" recommended worked so far.</p>
  
  <p>1) PHP manual recommends to save the credentials in a different file: check!
  All my PHP database classes insert the credentials from a different file.</p>
  
  <p><strong>Typical db class</strong></p>
  
  <pre><code>class database{
  private static $dbc = null;
  
  public static function get($page,$component = null){
      if(self::$dbc === null) {
          $root = $_SERVER['DOCUMENT_ROOT'];
          $path = '/some path/';
          $file = 'pdo.php';
          require( $root . $path . $file );
      }
   ...more code...
  </code></pre>
  
  <p><strong>credentials file</strong></p>
  
  <pre><code>$dbhost = 'some.host';
  $dbname = 'someDBname';
  $dbuser = 'someUser';
  $dbpass = 'somePassword';
  </code></pre>
  
  <p>2) Despite this, the file where I keep all the info in the web-host, the file can be sniffed or found.</p>
  
  <p><strong>How can I conceal this file, containing the database info, in order to have a REALLY secure website and database?</strong></p>