security question.

just_nobody

to connect to a databes you have to use

$db = mysql_connect("host", "user", "password");
mysql_select_db("dbname",$db);

but then your password and username is written in the script... isn't that unsafe for hackers?
is there an other way to do this? or can't they get to the script?

cahva

Yeah it is. And they can get to the script.

I put my connection scripts in to a different directory and protect it with htaccess. Thats not foolproof, but I dont think theres any other(better) solution.

just_nobody

what is this htacces you are talking abt? :o

Cogen

Sorry, can you explain what you mean by "password and username is written in the script". I connect to a mysql database on my site, however I had no idea the code was unsecure.🙁

michael

For starters, group your scripts into one directory. (And for god's sakes, don't call it php.)
include a index.php in it of 0 bytes.
Protect it with .htaccess.
Require() all files you need. Do not let the end user know what they are called.

Make an account on the server just for selecting data.
Use this account for all of your data reads.

Remember, the more secure your site, the less happy you and your users will be.

michael

Ah yes, and the Tower of Hanoi.: Use a backup scheme that fits you.

Always back up your database information.

You cannot protect everything. Make it as difficult as possible.

Rotate passwords every 30 days.

Check variables which would allow users to traverse your directory, and/or view files.