How safe are yaml, xml or annotations to store relevant information?

Question

I usually code in PHP and I have seen in many applications some config files with a bunch of constants with relevant information, such as passwords, e-mail addresses, ip's of servers or other machines... hidden in the tree folder (or not so much hidden).

A good example of this is the wp-config.php file of Wordpress.

I wonder if is safer to keep this information in other file formats or even in a Database.

Is there any advantage on using yaml, xml or annotations like some frameworks (like Symfony) do?

Answer 1

Regarding the safety: what mario and PiranhaGeorge said (it depends on the location, the locatiion shouldn't be accessible by a browser)

Regarding the use of config files: keep in mind that you absolutely need a few informations first, before you can access more complex storage facilities. For example you need to have db access parameters or decrypt informations for crypted files. There are a few settings that have to be known at the start of the application and can't (easily) be changed during the runtime. Another example other than db access parameter could be include paths to plugin directories. These informations have to be changeable without starting the application first.

Ideally you want a format that is easily understandable by both the machine (for example the PHP interpreter) and the admin. The machine needs to spend as little time as possible in loading the configuration, the admin needs a way to change the application parameters in a simple way (think SSH and vi or other bash editors on a smart phone, if there is an emergency), for example if there is a need to switch between production and testing databases.

Answer 2

Inherently, these methods are no less secure than each other. I would say it's mostly personal preference what storage mechanism you use.

Some things to bare in mind (off the top of my head):

1. Be consistent - pick one storage mechanism for configuration and use it for all configuration.
2. Ensure files are stored outside of the web root, or configure the server appropriately, e.g. via .htaccess files, so they can't be read in the browser.
3. Ensure appropriate permissions are used, especially on shared hosting environments. You don't want another user to be able to read your config files.
4. If you're not storing configuration in PHP, you'll probably end up serialising and caching them anyway.
5. (2) and (3) applies to any cached configuration too.