where to store mysql_connect username and password

[mindows]

how do people store their username and password for mysql_connect? it seems like most people just store it in an include file, but wouldn't it be dangerous to store in a php file? if the webserver fails to handle the php file incorrectly, couldn't the php source be viewable through the browse?
it seems like you can also define a default username/password in php.ini, but they indicate that it could be easily read by anyone who can view your environment variables.

so, how can i store mysql username/password securely?

[Romantik]

Code: Select all

<? # config.php
$dbName=  "dbName";
$dbUser=    "dbUser";
$dbPass=    "dbUserPass";
$dbServer=  "dbServer";

$dbh= mysql_connect(....)or die(...);
$res= mysql_select_db(.....)or die(...);
?>
// We bear this file for limits server
<? #YourScript.php
require_once("YourPath/config.php");
// Your Code
?>

[mindows]

Code: Select all

<? # config.php
$dbName=  "dbName";
$dbUser=    "dbUser";
$dbPass=    "dbUserPass";
$dbServer=  "dbServer";

$dbh= mysql_connect(....)or die(...);
$res= mysql_select_db(.....)or die(...);
?>
// We bear this file for limits server
<? #YourScript.php
require_once("YourPath/config.php");
// Your Code
?>

don't you still have to have rx permissions on config.php in order for require to work?

[Oleg Butuzov]

just do it... test it.

[mindows]

just do it... test it.

i know the above code works, nike. my problem is that *anyone* on that system can read the config.php file.

[pootergeist]

you probably just want to put it beyond public access and sling a .htaccess in the folder to assure calling headers included your domain as the request_uri

[mindows]

you probably just want to put it beyond public access and sling a .htaccess in the folder to assure calling headers included your domain as the request_uri

ok. I use a php hosting service that hosts about 30 some php sites on a linux machine. I can't just rely on some honor system where other acounts on the same linux machine won't look at my config.php. I just did a quick grep on a machine and found a bunch of mysql_connect statements. This is very disappointing.

[Redcircle]

on a shared server there is really not much you can do.

[Oleg Butuzov]

i know the above code works, nike. my problem is that *anyone* on that system can read the config.php file.

1) Who is nike?
2) Anyone can read vars from script if thay using your server...

[Redcircle]

So, if you run a web hosting service, pretty much security is down the drain? Are we saying that PHP is not meant for professional hosting then? If I have a database of user credit card numbers, then it's pretty much a free for all if you can get any type of access to the box?

It all depends on how the server has thier configuration. Most systems it is secure enough to make it difficult for people to get into and have resrictions from people accessing scripts cross domain. What I would do for your config.inc.php is make a dir behind the public_html. The only thing is no system is hacker proof. Credit Cards should NEVER be stored on a shared server. no exceptions.

[**TVH*]

just do it... test it.

i know the above code works, nike. my problem is that *anyone* on that system can read the config.php file.

PHP provide a lots of encrypt function, use it to protect your database info.