security - How to protect passwords given inside PHP so people browsing the code will not see it -

i making php script people have purchase.

<?php     session_start();     $dbhost = "localhost";     $dbname = "planeub9_airmanagemembership";     $dbuser = "planeub9_malcolm";     $dbpass = "mypassword";      mysql_connect($dbhost, $dbuser, $dbpass) or die("mysql error: " . mysql_error());       mysql_select_db($dbname) or die("mysql error: " . mysql_error());   ?> 

is there way db password can hidden plain view?

i start assuming release tarball or zipfile of software project, rather granting access whole git repository. this, can use git archive create release of project.

before this, need ensure configuration file not committed version control. if already, copy (for example copy "/config/base.php" "/config/base.php.example") , reset settings dummy values prior committing it. remove real config file version control whilst leaving physical file on disk.

to prevent file coming in git status uncommitted, add "/config/base.php" ".gitignore" file. prevent accidentally re-committing too. finally, add instructions in "readme" explain "base.php" needs created copy of "base.php.example".

---

now, if wish release whole repo and have committed configuration file, have 2 options. firstly, can take above advice removing repo now, , change database credentials. leave private details in repo, out-of-date , harmless.

or, can excise configuration file repo entirely using git rebase. causes problems if have pushed project other contributors, have pull fresh copy , re-apply pending changes. however, remove entirely history, unavoidable (and if let collaborators know going on, quite easy manage).