Configuration and environment

The database password, the payment key and the site address differ between your computer and the server. If you write them straight into the code, it has to be edited on every move, and secrets end up in the repository. Settings are kept apart from the code.

A configuration file

The simplest way is a file that returns an array:

<?php
// config.php
 
return [
    'app_name' => 'Shop',
    'per_page' => 20,
    'db' => [
        'host' => '127.0.0.1',
        'name' => 'shop',
    ],
];

<?php
// index.php
 
$config = require __DIR__ . '/config.php';
 
echo $config['db']['name']; // shop

require returns whatever the included file returned. This is how settings shared by every environment are kept.

Environment variables

Values that change from server to server, and secrets, are passed through environment variables. The getenv() function reads them:

<?php
 
function env(string $key, mixed $default = null): mixed
{
    $value = getenv($key);
 
    return $value === false ? $default : $value;
}
 
echo env('SHOP_MODE', 'production'); // production

If the variable does not exist, getenv() returns false — the wrapper function supplies a default.

The .env file

During development it is convenient to keep the variables in a .env file in the project root:

APP_ENV=local
DB_HOST=127.0.0.1
DB_NAME=shop
DB_PASSWORD=secret

The format matches an ini file, so a built-in function can parse it:

<?php
 
$env = parse_ini_string("APP_ENV=local\nDB_HOST=127.0.0.1\nDB_NAME=shop");
 
echo $env['DB_NAME']; // shop

For a file use parse_ini_file(__DIR__ . '/.env').

The phpdotenv library

In real projects a library reads .env — it understands quotes and comments and checks required variables:

composer require vlucas/phpdotenv

<?php
// bootstrap.php
 
require 'vendor/autoload.php';
 
$dotenv = Dotenv\Dotenv::createImmutable(__DIR__);
$dotenv->load();
$dotenv->required(['DB_HOST', 'DB_NAME']);
 
$pdo = new PDO(
    "mysql:host={$_ENV['DB_HOST']};dbname={$_ENV['DB_NAME']}",
    $_ENV['DB_USER'],
    $_ENV['DB_PASSWORD'],
);

What to keep in the repository

File	In the repository	Contents
`.env`	No	Real values and secrets
`.env.example`	Yes	The list of variables without secrets
`config.php`	Yes	Shared settings, reading the variables

The .env file is added to .gitignore. A new developer copies .env.example to .env and fills in their own values.

Modes

The APP_ENV variable tells the code where it is running. Error display, for one, depends on it:

<?php
// bootstrap.php
 
$isLocal = getenv('APP_ENV') === 'local';
 
ini_set('display_errors', $isLocal ? '1' : '0');
ini_set('log_errors', '1');
error_reporting(E_ALL);

On your own machine errors are visible on the page; on the server only in the log.

Common mistake

A .env file that got into the repository or sits in the site's public folder gives away every password. Check two things: .env is listed in .gitignore, and the web root on the server is the public folder, not the project itself. If a secret did get into the repository, it must be changed: it will never leave the change history.

Thanks for reading!