MySQL database password security...

airJX

Hello everyone,

I am a long-time programmer and I've just started working with php. I think I'm getting the hang of it, I just got my db login working, made some tables and stuff. There's just one thing I'm kind of worried about; in my source I just 'give away' the password to my database.

When logging into my database, my code just says:

$db = mysql_connect('db.host.com','dbname','dbpassword');

Is this sercure enough? I know the code is executed for the user and creates an html-page for them, but is there really no way for users to get the direct source code?

Greetings,
Alex.

donkeychoker

Hi, I am relatively new to php myself but i think I am correct in saying that that info should always be in it's own file as if you have server problems or php handling problems it would display all this info in screen.

<?php
$db_host="localhost";
$db_user="username";
$db_password="password";
$db_name="db name";
?>

Save these 4 lines of code as a file as anything you like. eg : db_con.php

Then to link to this file use this (or similar) on your page:

require ($_SERVER["DOCUMENT_ROOT"] ."/db_con.php") ;
$connection = mysql_connect ($db_host, $db_user, $db_password) or die ("error connecting") ;
mysql_select_db ($db_name, $connection);

My connection file is in a passworded folder in my root directory on the server for added security

airJX

That sounds a whole lot better than what I'm doing. 🙂

Thank you!

donkeychoker

You're welcome

MarkR

You should not hard-code these values into your main code because it creates a deployment problem moving code between development and live environments.

Normally I'd put the details in constants in a file called config.php in a subdirectory (normally /include)

This .php file would not normally reveal the password if the user managed to access it, but just in case, I'd have a .htaccess in that /include directory containing:

Deny From All

Which (usually) prohibits Apache from serving the contents of the directory to anyone.

Mark

stylez

require ($_SERVER["DOCUMENT_ROOT"] ."/db_con.php") ;

Does "/db_con.php" determine the location of the connection file ? Since you pass $connection into selecting a certain database, mysql_select_db ($db_name, $connection); can you also specifiy other connections with different privledges to certain tables as well? I'm also trying to secure the login connection.

donkeychoker

Hi,
require ($_SERVER["DOCUMENT_ROOT"] ."/db_con.php") ;

is the location of the connection details needed for $connection.

Mine is in a folder called conf which is .htaccess protected.

require ($_SERVER["DOCUMENT_ROOT"] ."/conf/db_con.php") ;

In the conf folder I have different connection files with different privilages for different scripts.

stylez

Ah, gotcha.

You brought the point that you have multiple connections scripts for different level of users? I'm also under the same situation and I'm not sure how to attack the problem. I'm creating a workorder database that will have 3 levels of user, an Admin that will be able to add/remove users to tables and modify table input. Workers that have read/write privledges on the indivdidual workers. Last, users that will have only read privledges to the workorders. I'm not sure how many mySQL accounts I would need and which to call depending on where they are from. I was thinking just a mySQL read account to check which table they authenicate against, than disconnect them and use the correct connect.php file to get them on? Any sugestions ? Thanks for your time.

donkeychoker

Hi again, afraid i am a novice like yourself as far as php +mysql goes. My scripts are not for user interaction and merely call for info from different tables and in some cases different databases and display the results on fitterent web pages

I would wait for one of the experts to reply, there are many of them and am sure you will get the help you need

Good Luck