PHP: A config file in .ini or .php format?

Question

I'm working on a huge CMS system, and I asked myself what configuration format I should use.

There are two common formats for configuration files. The first one is an INI file, containg all the configuration properties. Then you can simply parse this INI file using build in PHP functions. A second option is to use a PHP file containing a regular PHP array with these configuration properties.

Now, it's easier to edit an INI file, but a PHP file give's you more options, for example it allows you to add a function which retrieves one of the configuration options while reading the configuration file.

Note: The PHP configuration file would only contain an array of configuration, no initialization functions or anything. (This is possible of course, but it's not implemented by default)

Now, what is recommend for me to use as configuration file? What is the most common format for a configuration file? Should I go for simplicity with the INI files, or with a more dynamic one using PHP.

One thing to note, this is not for personal usage. I'm planning to release the CMS system soon, and a lot of websites are scheduled already to change to my CMS system.

Answer 1

INI files have the disadvantage that they can't elegantly represent complex data structures like arrays. Therefore they are only useful for very simple configuration. Using a PHP file for configuration can be viewed as a security problem: Any code might be entered there. Worse, a simple syntax error like forgetting a closing quote could render the whole configuration unusable.

There are already common human-readable data formats. XML is extremely powerful, but overly verbose, and not every data maps cleanly to XML. JSON is another excellent format, but has a very strict syntax.

I would urge you to consider YAML. It is extremely easy to read, and includes JSON as a subset of its syntax.

this is a key: some value here
another key:
  - this is the first item in an array
  - another one
  - { inline: dictionary, has: values }
  - [ inline array, has, more, values]
  - "Quote this, if you like"

There are many more advanced features beyond simple dictionaries and lists, making this a very flexible format.

Answer 2

One other big reason to go with PHP -- security. If you expose that .ini file to the webroot, most typical web server configurations will serve that file as a plain text file exposing whatever configuration secrets your app has. A php file containing purely code will just return a blank page, if you don't bother to take any security steps which are also an option because you are now in a programming language that gives you options.

Answer 3

I think you need to consider the size and complexity of the configuration needed,

Do you need to read it often? always?
Do you need to be able to override the data on certain circumstances?

In most cases I would go for a php file, specially if you can put that file outside of the web server root and as a read-only file.

YAML is nice, but I guess can be expensive to process the config file on every request, you would need some sort of cache, and that of course would add complexity for something that could be really simple.

Answer 4

I would go with a .php file. While its very minimal, an ini file is still adding overhead to each page load as it gets opened and processed every time a value is read. Even if you load the entire file into memory, you still are doing extra work looking thigns up. You'd have the same issue with .xml or other format as well. A PHP file would be loaded once, and then as a bonus, cached by any PHP caching system you might have.

And really, is there much difference between this:

somesetting = 1

and this?

$somesetting = 1;

Both are just as easy to manage.

Answer 5

You said that a lot of websites are already scheduled to change to your CMS system, so it sounds like a question for them. Will these be managed by people so programming illiterate that they would be more comfortable editing an INI file that a PHP file with simple options? Would the loss in speed from parsing the INI file be an issue for them? Would they prefer the added flexibility a PHP config file would allow? Should the security concerns of using an INI file matter to them? Or perhaps you should allow both. Perhaps some people will appreciate the ease of editing an INI file and others the advantage of a PHP file. It seems the advantages of only having a PHP config file usually outweigh that of an INI file and that of having both. Therefore, perhaps it would normally only search for a PHP file, but in the case that it is started with special options, the system could be instructed to search for an INI file or even both. If necessary, it could be instructed which config file would have the higher priority should some of the same configuration options be in both.

Answer 6

Try to answer this question individually for each configuration file. A dependency injection container tree is actually also a kind of configuration, but who could change the file? It might only be another developer.

Writing a CMS means there are configuration files like database connection setups and so on, which might be edited by any luser, but they are more computer literate people. Do you think they can handle any "Unexpected T_STRING" messages? Maybe, maybe not. I recommend YAML as configuration format for non-developers in that case. Easy to read and when I create PHP projects with symfony, I can use the configuration component (http://symfony.com/doc/current/components/config/index.html), which produces error messages which everyone understands. You define your parse and validate tree in PHP and if the yaml file cannot be parsed you have your message.

If your configuration is for real luser it might be better to use INI.