Best practice in placing db connection file/folder

what is best for security?

[Storyman]

The site is PHP and uses MySQL.

When the database connection file is placed on the server is it better to place the db connection file or the connection folder at the root level.

In other words is it better to have the folders Connection and public_html at the same level?

Or to move the connection FILE up one level so the connection FILE and public_html FOLDER at the same level?

It makes life easier if the folders connection & public_html are on the same level because it means files can be uploaded without having to alter the
code that calls the connection file.

What it comes down to is if both approaches are equally secure or does one approach offer added protection over the other.

[mincklerstraat]

It's better to have your connection file 'under the document root'. Document root is where your html files begin - so if you have a public_html directory, stuff directly in this directory (and not in directories within this directory) are in your 'document root' or your web root. You want your connection file to be under this so it's not accessible by people accessing your webserver directly - there are ways of protecting files that are in your public_html directory, but you want this to be so secure that even if your hosting company goofs and php is switched off for a while (this does happen), nobody can look and see what's in that file. You'd be suprised how many db usernames and passwords I've seen out in public space (though lately it seems this happens less frequently).

So if you have a directory structure like this, put connect.php here:
/username/public_html/(all your web goodies here)
/username/connect.php

[Storyman]

mincklerstraat,

Just to be clear on this would both of these scenarios be comparitively secure? Or is one clearly a better choice.

/username/public_html/(all your web goodies here)
/username/connect.php (Is this more secure than...)
/username/connection/connect.php (...than this)

[mincklerstraat]

/username/public_html/(all your web goodies here)
- this just denotes that the stuff that your website actually 'shows' are in this directory, to give you an idea of 'where' the rest is

/username/connect.php
/username/connection/connect.php

Both of the above are good options. Go with either one - the first is probably easier.