Passwords in scripts. Are they safe?

abel122

Hello everybody. I have a question about passwords stored in php scripts.

For Example. mysql_connect("localhost","user","password"); is in a php script on the server. Is the script safe from intruders? Can someone somehow access this php script and see the password?

Any response will be greatly appreciated.

Abel

jweissig

Hi,

i think you are fairly safe from the password being exposed. But there are a couple things to keep in mind.. if the php script interpreter is off then your scripts will be displayed in plain/text and the password would be exposed.

Also you should be careful if you are using php/templates. I have seen several very sloppy forms where people state the template as a hidden field. If you do this and someone rewrites the form to show a php page, then they will be able to see the password.

Justin

hand

If it is possible, put your connect string

<?
// connect.inc.php
mysql_connect("localhost","user","password");
?>

in a file, store it outside of the webserver root and include it to your script.

<?
// ....
include("connect.inc.php");
// ...
?>

So nobody can read your connect string in the case the php script interpreter is down.

edwardsbc

If the php file is in the web directory tree it most certainly is NOT, I repeat, NOT safe. Do as suggested by "hand" and place an include file outside of the web tree. Ditto for any information you don't want divulged should the web server or php fail in a compromising way.

siwis

Good advice, not least for the fact that should you ever move the site to a different server or host, you won't subsequently have to rewrite all your scripts.

Place anything that gets used repetitively in ANY script, regardless of whether it is sensitive or not into your config file. Makes life SOOOO much easier.

Its the equivalent in php terms to the use of css for formatting 😃

abel122

Can you guys tell me what a webserver root is. I have seen it in many php tutorials yet none explain what it really is.

siwis

When you ftp in, you generally get dropped in to the level below web root (or possibly into your user area sdepending upon the server)
You will be told to place your website into a folder often called "web" or "public_html" or "www" or some other such folder. The insides of that folder are the root of your website ie web root.
The other folders you can see (often "logs" or access or some other such folders) are classed as "below web root" ie they cannot be accessed via a URL through a browser. They are therefore out of your web tree and you can place stuff at this level to keep it from prying eyes.
The only exceptions are when a specific folder has had an apache mod-rewrite rule created for it (but this is getting way too technical now!

So, in short, log in via ftp and get yourself (or specify within your ftp prog that the remote startup folder is "/" and you are now below web root. Create a folder here to house your sensitive stuff and call it into your scripts via its full server path (you might need to contact your ISP for that informations (or you caould create an error in one of your php files and have it tell you via the error mesage!)

undertow

Another way is to instead of including a file, actually have a file that gets opened with fopen() and the contents (just the password, nothing else) get read out.

I suppose the advantage of that is if PHP fails somewhere between processing any include()'s and running the interpreter (if that kind of problem is even possible), you won't need to worry about the password showing up because it's never really part of the script.

jerdo

One extra suggestion to what hand said, make that @include("connect.inc.php"); That way if something goes wrong, surfers won't be able to see the name of your file.