I am writing a large PHP application (with setup) for the first time and am wondering about the security precautions I should take for permissions.
setup.php uses uses fopen/fwrite to generate a config.php based on POST data that comes from setup.php. This works, but it seems that I cannot write to config.php unless I set permissions of it to
Config.php will essentially contain the database credentials in PHP variables (to be include()'ed), is this a good to leave as
I am wondering if that is alright or I should instruct the user to change permissions back to something such as 655 (I am not sure).