using passwords: variables vs. constants

[Dormilich]

Hello,

I'd like to collect some opinions about the question:
in which data type (variable or constant) it is best to store passwords for a database?

(I'm using PHP/MySQL but the matter should consist for other systems too)

// connecting to DB
mysqli_connect($host, $user, $pw);
unset($pw);
// vs.
mysqli_connect(HOST, USER, PW);

• on the one hand side constants can never be altered in the script and they are (in most cases) globally available.
• on the other hand side, I can destroy a variable's value after I used it. (you know, global variables are evil... *g*)

regards

[NeoPa]

I always have some sort of encryption for a password. That way, wherever it's stored (where this should be can vary between projects) it is not obvious what the password is.

Ultimately, password availability will always be a problem in code (If someone has access to the code it is very difficult to ensure they aren't able to get your password if it's stored in any form).