Managing Database Credentials with Environment Variables

Read database configuration from process environment rather than hardcoding secrets in code.

The examples focus on the operation itself, including the important distinction: A .env file is a local developer convenience, not a file to serve publicly.

What It Does

Use the examples below to observe the behavior on a small dataset before extending it to application code.

Before You Start

The examples use PHP 8.2+ features where shown. Database snippets require the corresponding PDO driver, demo tables, and credentials configured outside source code.

Example 1: Basic Use

Never echo or log the environment password. A readable .env file must be outside the public web root.

<?php
$user = getenv("DB_USER");
$password = getenv("DB_PASSWORD");
$database = getenv("DB_NAME");
if ($user === false || $password === false || $database === false) {
    throw new RuntimeException("Database configuration is incomplete");
}
echo "Configuration present";

This example is meant for a configured application environment; output depends on the installed extension, external service, or database contents.

Example 2: Checking Behavior

Never echo or log the environment password. A readable .env file must be outside the public web root. Database name and account may be logged for diagnostics, but never the password.

<?php
$user = getenv("DB_USER");
$password = getenv("DB_PASSWORD");
$database = getenv("DB_NAME");
if ($user === false || $password === false || $database === false) {
    throw new RuntimeException("Database configuration is incomplete");
}
echo "Database=" . $database;

This example is meant for a configured application environment; output depends on the installed extension, external service, or database contents.

Example 3: Practical Example

Never echo or log the environment password. A readable .env file must be outside the public web root. Database name and account may be logged for diagnostics, but never the password.

<?php
$user = getenv("DB_USER");
$password = getenv("DB_PASSWORD");
$database = getenv("DB_NAME");
if ($user === false || $password === false || $database === false) {
    throw new RuntimeException("Database configuration is incomplete");
}
echo "Configured user=" . $user;

This example is meant for a configured application environment; output depends on the installed extension, external service, or database contents.

Important Behavior and Edge Cases

A missing environment value must fail safely; environment variables still need OS-level protection and secret rotation.

Comparison with Related Approaches

Common Beginner Mistakes

Key Takeaways

• Read database configuration from process environment rather than hardcoding secrets in code.
• A missing environment value must fail safely; environment variables still need OS-level protection and secret rotation.
• A .env file is a local developer convenience, not a file to serve publicly.

Use Managing Database Credentials with Environment Variables when its documented behavior matches the problem. Test the relevant edge cases in your own runtime before deploying it.