I've to create a custom plugin to print data from a database different from the wordpress one. I'm using wpdb.

Is it fine, from a security point, to write database credantials in the plugin files in this way? Or should it be done in a different way?


function myfun() {
    $fundb = new wpdb('root', 'password', 'database', 'localhost');
    $result = $fundb ->get_results("SELECT * 
FROM  `table` 
ORDER BY  `table`.`column` ASC ");

1 Answer 1


As long as you aren't passing out the plugin and other people don't have access to it, you should be fine.

You might add something like the following to the top of the file just in case though:

defined('ABSPATH') or die('Access denied');

That will simply make sure that the file is loaded via wordpress (e.g. the wordpress ABSPATH constant has been defined)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.