title: a better approach than storing mysql password in plain text in config file?
body: <p>It's always bothered me that many PHP programs require the user to store the mysql password in plain text (in a string or constant) in a configuration file in the application's root.</p>
  
  <p>Is there any better approach to this after all these years?</p>
  
  <p>So far I have come up with two minimal security boosts:</p>
  
  <ol>
  <li><p>make the file unreadable via the web using rules in .htaccess 
  (in case php fails or there's a security vulnerability to read php source)</p></li>
  <li><p>destroy the password in memory after the db connect is made (unset) 
  (to prevent string dumps from a security breach, injection, etc.) </p></li>
  </ol>
  
  <p>but of course neither of those solve the original problem.</p>
  
  <p>Thanks for any other ideas!</p>