Hiding your MySQL password

Anon

hi all,

i am in need of advice. I was wondering if it is possible to hide the password that you use to log on on to the database your accessing?
eg. mysql_connect($host, $user, $pass); <-- is there a more secure way to do it?

Anon

Yes. Put your connect statements in a file (connect.inc) or something like that, put it into a directory, and then htaccess the directory. Eventually, you can also change the ownership so that only you and apache/php can read the file and/or directory.

Anon

I'd suggest that you put just your password and username variables in a separate file and put that file outside of the webroot, then just include that file in the scripts that you need to access the database from. This way if someone does get a way to access the files through the web server they still won't be able to access your username/password.

Ofcourse you should also protect this file by only allowing the users that need access to it to use it (your username, and php's group).

Anon

Great! thanks people 🙂

Anon

After looking at several options.. what would be the best way to implement it? I have used require() and include() and they just end up printing the data to the screen..
i am only new to php and am having some troubles..

Anon

Build your script that holds your variables like this:

<?php
$user = "me";
$pass = "mypassword";
?>

Call it something like dbaccess.php, or something more obscure if you prefer. Then just include it before your line:

mysql_connect($host, $user, $pass);

Anon

i actaully did that.. and for some unknown reason it displayed the variables to the screen..

eg.
..

<? include(../inc/connect.inc); ?>

mysql_connect($server, $user, $pass);

then i mucked around a little trying to see what it was doing.. byt echo'ing some of the variable values.. and it was still printing all of the values to the screen in a list eg.

$user = "joebloe"; $server = "localhost"

etc..

so i am a little bewildered

Anon

Read this: http://download.php.net/manual/en/function.include.php

Espically this section:

An important note about how this works is that when a file is include()ed or require()ed, parsing drops out of PHP mode and into HTML mode at the beginning of the target file, and resumes again at the end. For this reason, any code inside the target file which should be executed as PHP code must be enclosed within valid PHP start and end tags.

If you don't have the <?php ?> tags in you included file php just assumes that it's HTML and sends that information to the screen.

Anon

Great info,
What would be the most effective way to protect this file from being read, but still readily accessible to the script, i.e., CHMOD, .htaccess, etc.
Sorry for maybe obvious question, but I'm a consumate "Newbie" to PHP/MySQL & database driven sites.