[squidsk]

Originally Posted by X-or

You missed his point which is the password isn't crypted.

Not really you missed that point that if the file is not accessible the password within the file does not need to be encrypted because no one can access it to see it. You only need to encrypt things if you don't want others who are looking at it to be able to see what it is. Since no one can look at it, in a properly configured setup, why would it be encrypted as all that does is add unneeded overhead to every single page view.

--------------- Added [DATE]1441914930[/DATE] at [TIME]1441914930[/TIME] ---------------

Originally Posted by loua_oz

That is another question: why is it then in /includes, why not in /install and removed before the site is powered up?

Because for every action on the site, whether its to login, view a page, create a thread, make a post, all require db access, which requires the credentials (username, passoword) so the credentials need to be accessible.