Secure way to pass a db pswd to a script

[julio2001]

I'm sure this is an old topic, but i can't find an answer:
all my php scripts accessing a database have an include of a file containing variables with database name, user and password.
obviously this is not a secure way to protect my db because the include file is accessible via web browser (knowing is name)
which techniques do you use to make password available to scripts on a secure way?

thanks in advance

[grimz]

Why not just name the file .php and include it then ?

Browsers don't display .php as plain text.

[rrijnders]

Whether the browser can display these files or not is up to you. If you are running apache and the file extensions of your included files is ".inc", then you can keep the web server from feeding the file to the browser by changing your "httpd.conf" file with a generic directory directive for your http root like so:

<font color=blue>
<Directory /usr/local/etc/httpd/htdocs>

Options none
AllowOverride none

Controls who can get stuff from this server.

<Limit GET>
order allow,deny
allow from all
</Limit>
</font>
<font color=red>
<Files *.inc>
Deny from all
</Files>
</font>
<font color=blue>
</Directory>
</font>

-- Rich