in reply to Possible CGI/database security issue?

Another reason to separate out your databse connection info (and my primary reason) is code distribution. If you release your code to outsiders (whether business partners or under a Free/Open Source license), do you really want to lose sleep wondering whether you remembered to remove the password for your private database each time? Do you want that information available in the CVS archive? Not likely...

And then there's standardization. FHS says that all system-wide application configuration data belongs under /etc and I tend to agree with it. Life is so much easier for admins when everything puts its settings in /etc/appname (one config file) or /etc/appname/* (multiple config files).

  • Comment on Re: Possible CGI/database security issue?