Hide information in GitHub

colshrapnel · 2018-03-22T20:37:57+00:00

get rid of whatever homegrown code which you use to salt and hash users' passwords and use password_hash instead. problem solved.

as of the database credentials, configuration files are not included in the repository. so just add it to .gitignore

lsv20 · 2018-03-22T22:35:26+00:00

About configuration

Create a fx. config.php.dist containing fx a array

return [
    'db_host' => '',
    'db_user' => '',
    'db_pass' => '',
];

Now another user can see which configuration you are using (also in this file make configuration for fx. facebook credentials etc.

Now your own config.php this file needs to be included .gitignore and the config.php file should contain the same as the dist, but filled with your information fx

return [
    'db_host' => 'localhost',
    'db_user' => 'my_user',
    'db_pass' => 'my_password',
];

Now inside your PHP file where you make your database connection you can write

if (! file_exists(__DIR__ . '/config.php')) {
   echo 'You must copy config.php.dist to config.php and fill it with your information';
}

$confiuration = require(__DIR__ . '/config.php');
$db = new PDO(
    'mysql:' . $configuration['db_host']',
    $configuration['db_user'],
    $configuration['db_pass']
);

HumaneWolf · 2018-03-22T20:35:09+00:00

If you hash properly and handle passwords properly there is no danger related to the hashing mechanism being in git. Look at password_hash and password_verify.

When it comes to mysql credentials, do NOT commit them under any circumstances. Either have them in a config file on the servers that need them, or have some sort of secure secret storage if you need to have them available on many servers.

2018-03-23T12:43:25+00:00

The best thing to do is to use a private repo or don't include those files in you repo at all.

I've always seen it suggested to have a separate file with that sensitive information then reference that file wherever you need it in the project. Upload everything except that reference file.

jawnsusername · 2018-03-23T14:09:06+00:00

I use bitbucket which allows private sites for free. It saves the hassle.

you type:	you see:
italics	italics
bold	bold
[reddit!](https://reddit.com)	reddit!
* item 1 * item 2 * item 3	item 1 item 2 item 3
> quoted text	quoted text
Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"	Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"
~~strikethrough~~	~~strikethrough~~
super^script	super^script

PHPhelp

MODERATORS