Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I looked at this question: What is the right way of storing database connection strings from the security point of view?

and I'm wondering specifically for connecting to a mysql databse with PDO, how can I be more secure?

  1. I currently store my password in plain text in a .php file.
  2. If storing outside the root is optimal, how can I include this file when I must access the database in index.php for example?
share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

Use include or include_once to include anything in PHP.

<?php
include_once("/etc/out-of-htdocs/password.php");
?>

The PHP code can access files, which are not accessible via an URL. That is the security benefit.

In case of a miss configuration of the PHP module it is possible that every PHP file gets delivered without evaluation, which means that the password is world readable for everybody. If the PHP file is not accessible via an URL a configuration problem of the PHP module does not have any impact in the password security.

share|improve this answer
    
On top of that: Limit MySQL connections by IP/blocks, can't be too paranoid. –  StrangeWill Jan 24 '12 at 14:54
add comment

I want to add to the original question - maybe there is a way not to store the actual password in a file at all? Just to keep a hash in it so if the PHP files somehow are downloaded attacker can`t do that much.

I think it's not a farfetched example, because sometimes it's not possible to store configuration file away from the directory which is accessible via FTP which can be easy forced.

share|improve this answer
    
You can store the password e.g. in an environment variable reading it via the $_ENV array, so reading PHP code will not reveal the password, but if attacker is able to trigger a code execution, he can still access the password. –  Krzysztof Kotowicz Jan 3 '12 at 0:59
    
Good point. Maybe, i can use something similar with encrypted RSA keys. Around the document root i store encrypted key, which is decrypted into memory (like ssh-agent). Password can be stored in memcached for example. This is more real. –  Xenon Jan 3 '12 at 9:56
1  
Using environment variables for secrets would generally be discouraged, because on many OSes a process's initial environment is readable to any user logged-in on the server. –  bobince Jan 24 '12 at 8:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.