[TheLastSuperman]

Originally Posted by MaryTheG(r)eek

Hello all,



Here is a very easy way to protect your config.php (and thus your valuable database):

1. Copy your config.php from /includes/ directory, over the public area so nobody can access it with the browser.
2. Open the config.php that still exists in /includes/ directory and remove all the code.
3. Add only the following code:

<?php
require_once("/home/**username**/config.php");
?>

Ofcourse you need to replace **username** with your FTP username. Maybe you need to change the path. This example is from cPanel configuartions.

That's all. Connection details to your database are now hidden to hackers.

Maria
PS- I did a search before posting the advice, but I didn't found anything. If a similar article exists, then my apologies, but is well hidden

https://vborg.vbsupport.ru/showthread.php?t=198856

I prefer the above as many simply do not know about this and not to mention your telling a hacker where config.php is within the old config.php when/if they have a copy although they may not think to look for the edit within class_core (if you do not preserve timestamp info when editing or uploading the modified file) . The only drawback is vB4 does not like it to be renamed when upgrading, vB3 did not care - that's simple to bypass though, before upgrading change it all back then redo the changes again once you've upgraded and your good. You can then leave a cloned config.php in place within includes and fill it w/ all sorts of false information.