MySQL/CGI: password in C source file unsafe?

Question

Is this line bad practice from a security stance?

connect = mysql_real_connect(connection, "host", "user", "password", "database", 0, (const char *)NULL, 0);

If so, what solution would you use?

Edit

void get_credentials(char* host, char* name, char* passwd, char* db) {
  char string_path[80] = "/etc/.acro";
  struct stat sb;
  stat(string_path, &sb);
  int file_OK = FILE_OK;
  if (sb.st_mode == 0644) {
    fprintf(stderr, "Corrupt login file: permissions");
    file_OK = FILE_BAD;
  }
  /* if(file_meta->st_uid != ???) {
       fprintf(stderr, "Corrupt login file: owner");
       file_OK = FILE_BAD;
     } */
  if(file_OK) {
    FILE *login_file = fopen(string_path, "r");
    fgets(host, 80, login_file);
    fgets(name, 80, login_file);
    fgets(passwd, 80, login_file);
    fgets(db, 80, login_file);
    host[strcspn (host, "\n")] = '\0';
    name[strcspn (name, "\n")] = '\0';
    passwd[strcspn (passwd, "\n")] = '\0';
    db[strcspn (db, "\n")] = '\0';
    fclose(login_file);
  }
}

Edit 2

The permission check should look like this for a 700 file:

// 33216 = 100700 in octal => rwx for owner only
if (sb.st_mode != 33216) { 
    printf("Corrupt login file: permissions");
    file_OK = FILE_BAD;
}

Answer 1

Yes, for several reasons.

One, someone with read access to the binary could potentially run the strings command and look for likely possibilities near the phrase 'localhost'.

Two, if you ever decide to use the program elsewhere, you currently have the options of 1) setting up the exact same database on localhost with the exact same username and password (really unwise) or 2) altering the source code and recompiling for the second platform.

Alter the program to read its connection data from a config file in either /etc/programname/program.conf or ~/.programname/ depending on the flavor, and make it insist on having the directory permissions set to 700 and enforce proper ownership.