DataBase Protect

Anon

Let say i set the password and id for the database, while i need to connect to
the database with php,i need to connect it
with the id n password in the script.

If someone able to download my scriptfile
and database, then he/she will be able to
read the data.

How do i protect ?

Anon

The key would be not allowing them to download your scriptfile.

That's pretty much the only protection, as if they can download the scriptfile without the PHP parser going at it, you've got a bigger problem than just someone being able to access your database.

Specifically, inproperly configured apache and php configuration files.

Anon

Hi,

A thing I've found which works well is to name the file which includes these things something like config.inc.php, where 'php' is the extension that represents server-parsed files on your server. Have this file do nothing that outputs anything, but rather just defines variables, performs connections, defines functions, etc., and when a user attempts to download it, they will get a "File contained no data" error because the file doesn't output anything. This is a trick I learned from phpMyAdmin and used in my project's second revision (Ticketsmith).

Cheers,
Justin

Anon

So the script file cannot be download
even they use these program like teleport
or snake (which is use to download the whole
site) ??

how i avoid database download by other people from the server ?

Anon

If this were an issue do you really think anyone would be using PHP??

Think about it...The code is on your server. It gets parsed by PHP, and ONLY HTML IS SENT TO THE BROWSER. None of your code leaves the server.

These programs you mentioned probably follow every link and save the files and images and stuff. Well, all their going to get is the HTML generated by your PHP files, none of your code.

Your welcome.

---JH

Anon

I don't think that would be true for 'mirror'. I use it to suck the redhat releases, and it uses ftp. It doesn't follow 'links'...

Seems like the only real solution would have to involve access permissions...

John Holmes wrote:

If this were an issue do you really think anyone would be using PHP??

Think about it...The code is on your server. It gets parsed by PHP, and ONLY HTML IS SENT TO THE BROWSER. None of your code leaves the server.

These programs you mentioned probably follow every link and save the files and images and stuff. Well, all their going to get is the HTML generated by your PHP files, none of your code.

Your welcome.

---JH

Anon

It must use some kind of anonymous ftp, if anyone can use it to get files.

If the server is set up correctly, no one will be able to get your code unless they have your login and password.

Anon

The key part is, it uses ftp. Apache doesn't have PHP parse files transfered over FTP.

So, you'll need to make sure ftp access to your files is not available. Not sure how to do that, but it woulld be a good question, heh.