diff --git a/aandjtunnel.php b/aandjtunnel.php
index e9ba14a..fe4caf8 100644
--- a/aandjtunnel.php
+++ b/aandjtunnel.php
@@ -1,14 +1,15 @@
 <?php
 
+    // phpmailer
     use PHPMailer\PHPMailer\PHPMailer;
     require 'vendor/autoload.php';
 
-    date_default_timezone_set('Asia/Taipei');
+    // settings and secrets
+    require 'setting.php';
 
-    $url = 'http://host/path/to/site';
-    $austin = 'austin@gmail.com';
-    $joyce = 'joyce@gmail.com';
+    date_default_timezone_set($timezone);
 
+    // mailer settings
     $mail = new PHPMailer;
     $mail->isSMTP();
     $mail->CharSet = 'UTF-8';
@@ -19,43 +20,47 @@
     $mail->SMTPAuth = true;
 
     // SMTP Auth
-    $mail->Username = 'service@gmail.com';
-    $mail->Password = '30fLS_439GW1cvnslDLS29d';
+    $mail->Username = $auth_google['user'];
+    $mail->Password = $auth_google['password'];
 
-    $dbhost = '127.0.0.1';
-    $dbuser = 'military';
-    $dbpass = 'militarysucks';
-    $dbname = 'military';
-
-    $mysqli = new mysqli($dbhost, $dbuser, $dbpass, $dbname);
-    $mysqli->query("SET NAMES utf8");
+    // create database connection
+    $mysqli = new mysqli(
+        $database['host'],
+        $database['user'],
+        $database['password'],
+        $database['name']
+    );
 
     if (mysqli_connect_errno() ) {
         echo 'Failed to connect to MySQL: ' . mysqli_connect_error();
     }
 
+    $mysqli->query("SET NAMES utf8");
+
     if (isset($_POST['message']) && $_POST['message'] != '') {
-        $new = $_POST['message'];
+        $new_content = $_POST['message'];
+
         if (isset($_POST['user']) && ($_POST['user'] == 'A' || $_POST['user'] == 'J') ) {
-            $user = $_POST['user'];
-            $now = date("Y-m-d H:i:s");
+            $new_user = $_POST['user'];
+            $new_time = date("Y-m-d H:i:s");
+
+            $sql = 'INSERT INTO messages (content, user, datetime) VALUES ("'.$new_content.'", "'.$new_user.'", "'.$new_time.'")';
 
-            $sql = 'INSERT INTO messages (content, user, datetime) VALUES ("'.$new.'", "'.$user.'", "'.$now.'")';
             if ($mysqli->query($sql) != TRUE) {
                 echo "Error: " . $mysqli->error;
-            } else {
 
+            } else {
                 // notify joyce
-                if ($user == 'A') {
+                if ($new_user == 'A') {
                     // Recipients
-                    $mail->setFrom($austin, 'Austin');
-                    $mail->addAddress($joyce, 'JoyceHuang');
+                    $mail->setFrom($users['austin'], 'Austin');
+                    $mail->addAddress($users['joyce'], 'JoyceHuang');
 
                     // Mail Content
                     $mail->isHTML(true);
                     $mail->Subject = '來自Military Tunnel的新訊息';
-                    $mail->Body = '<a href="'.$url.'" style="color: #164187;">'.$new.'</a>';
-                    $mail->AltBody = $new;
+                    $mail->Body = '<a href="'.$home_url.'" style="color: #164187;">'.$new_content.'</a>';
+                    $mail->AltBody = $new_content;
 
                     if (!$mail->send()) {
                         echo "Mailer Error: " . $mail->ErrorInfo;
diff --git a/setting.sample.php b/setting.sample.php
new file mode 100644
index 0000000..4d0a534
--- /dev/null
+++ b/setting.sample.php
@@ -0,0 +1,21 @@
+<?php
+    $timezone = 'Asia/Taipei';
+    $home_url = 'http://domain.name/path';
+
+    $users = array(
+        'austin' => 'sample@sample.com',
+        'joyce' => 'sample@sample.com'
+    );
+
+    $auth_google = array(
+        'user' => 'sample@gmail.com',
+        'password' => 'secret'
+    );
+
+    $database = array(
+        'host' => 'secret',
+        'user' => 'secret',
+        'password' => 'secret',
+        'name' => 'secret'
+    );
+?>
\ No newline at end of file