Security question with db connection 1

[jisoo23]

Probably a simple question but just wanted to confirm with others...

I include a separate php page on each of my website's pages that contains mysql_connect and mysql_select_db. Is there any security risk with this? Or since PHP is processed on the server end it doesn't matter?

I'm just trying to avoid the risk of someone being able to grab the database information and messing things up. If there's a risk, what precautions could I take to prevent this from happening? I'm thinking a separate subdirectory with different chmod permissions perhaps....

Thanks for the input,
Jisoo23

 

[KarveR]

provided it has a .php extension it shoud be fine. (as long as you don't echo any details on errors.

______________________________________________________________________
There's no present like the time, they say. - Henry's Cat.

 

[sleipnir214]

I strongly recommend that the included file reside on the filesystem outside of the document root of your web site. That way, if something should happen to your web server's configuration that would allow php files to be sent to a browser as-is (send them, rather than running them and sending the output), your password will not be exposed.

I also recommend that you lock down the privileges of the login user your script uses as much as possible. MySQL, for example, gives the ability to allow a user to login only from certain IP locations. If your script's MySQL user could only login from localhost (assuming that your web server is also your database server), then the value of that login is reduced to a hostile entity.

Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[jisoo23]

So putting the include file outside the document root of the website...you're talking about placing it outside of the "public_html" folder?

 

[sleipnir214]

Yes. PHP's include(), include_once(), require() and require_once() functions are not constrained by the current document_root. You can put the files anywhere on the filesystem and still include them -- you just have to specify the correct path.

Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[jisoo23]

a-ha, I'll be sure to do that. Thanks for the security tip!