The "right" way to set environment variables in PHP website applications?

Question

I saw many letters about storing hard-coded information (API key strings, database passwords) as environment variables for security. I am a little new to this concept, and although I have seen a lot for rails, not so much on the PHP side.

Even PHP FOG uses this type of setup when creating the mysql DB source information for the user.

I really don't understand where this is installed, and how it is extracted using any particular php webpage / application. I really look at this in terms of something like keeping my transaction email API keys and other information safe and useful across multiple pages.

For example, if I just create a config.php file and put it in my site root, is it really something other than a key call directly inside my code? Where should environment variables be set and what is the most efficient way to call them? I am also wondering how this differs from SESSION variables?

Note. I am running a LAMP stack with a pair of Nginx.

Update 1: One of these users is inclined to think against using environment variables and only in “non-public” files, but I really don’t see how much this is different.

Update 2: I also found this article, which seems to make common sense from a Windows point of view (provided that * nix needs to change the path to include php?). Again, what are the benefits of this, and not just hard coding an API key directly in a PHP script?

Answer 1

I would say that this is just a flavor of system integration, rather than security-related.

Environment variables can be used to create the context in which the script is executed. The script itself takes them as a (hidden) dependency.

Thus, you can execute the same script in different environments (environment settings) without changing a single line of code (including, but not limited to) php based configuration files.

For example, when deploying scripts automatically, deployment systems can usually set environment variables because the principle is common. You do not need to modify deployment scripts so that they know about your specific configuration files so that they can modify them.

From a security point of view, the difference is not very large. Environment variables can be accessed publicly, and you can also access the global variable inside the script.