Hiding passwords?

Anon

Is is possible to "chmod" a PHP file so that no other user (but the browser) on the same server can read them.

I am using a mysql-connection in my php-file
and I have noticed that any logged on user can read it. Therefore they can also read my mysql password.

Anon

Hi!

What do you mean 'any logged-in user can read it'?
Only the person who has FTP-read rights to your directory can actually read the file as text. All other people who access it through the browser are only reading what is parsed by the PHP interpreter, and unless you explicitly print your password and login using the echo or print statement, on-one will ever find out your password.

Hope this helps,
Stas

Anon

-->Stanislav-
I think Jens is talking about other people logged onto the server through a terminal shell, not a browser.

-->Jens-
Each server is set up differently, so you might ask the admin, or try "chown nobody file" where "nobody" is the name of the web-server user. of course, then you can't change it unless you either write a php script to do it 🙂 or become root user. 🙂

-jed

Anon

Sorry about that then.

Stas

Anon

Thank you Stanislav!
I guess that's what I have to do, unless someone else has a better solution 🙂

Jens D.

fintan

if you:
chmod g-r file
then none of the other users on that machine can read it... however, probably would be better to:
chmod g-a file
and they cant do anything to it...

one presumes you are the only one logged in as you...

Talk to ya later,
Fintan

Anon

Yes, but then the browser cannot read the file either, or? The browser has to belong to some group too - am I not right?

Another problem is that every user belongs to their own group, e.g.:
-rw-r--r-- 1 jens jens ... myfile.php

[deleted]

The webserver runs as a user, all HTML and PHP files must be readable by the webserver.

On a badly configured shared server, that means that every html and PHP file is readable by every other user through a PHP script.

There are ways to prevent this, but they require that your host changes his setup.

http://www.hvt-automation.nl/yapf/faq.php?cmd=viewitem&itemid=108

A forum, a FAQ, what else do you need?