0
votes
1answer
89 views

What are common problems that reveal PHP code? [closed]

What is the best method for securing PHP scripts that contain database passwords? From what I've read, PHP can be revealed when an error occurs and is not caught. Is there any way to reveal PHP by ...
0
votes
1answer
70 views

Removing Unnecessary Services & Packages in a MySQL Ubuntu 12.04 Server [closed]

As part of hardening a MySQL 5.6 server running on Ubuntu 12.04 LTS, unnecessary services and packages will have to be removed. For a server that is serving only as a MySQL server, what services and ...
5
votes
1answer
3k views

Building a web app with encrypted MySQL database entries?

I have some experience in building PHP based websites with MySQL access, storing encrypted user details, but all other fields being plain text. My most recent project will require sensitive data to be ...
2
votes
0answers
412 views

Where to store sensitive client details (MYSQL DB credentials) [duplicate]

I have a security related question about storing some client information - specifically their database login credentials. My app works based on the client and so the database details need to be set ...
7
votes
2answers
563 views

Sending data form registration forms

I understand that sending data from the user to the server, unencrypted, is a bad practice. That is logical. So how do I encrypt 'userside' and send the data to the server in encrypted form? Can ...
0
votes
1answer
251 views

Protect database resources from fake data inputs via web forms

Scenario: I'm working on a project that needs to accept large amounts of data (customer data) from its users. So it can be normal to have a user trying to add 10,000 or 100,000 records at a time. In ...
2
votes
2answers
461 views

Potential insecurity in not sanitizing variables before INSERT with prepared statement in PDO

I use PDO with prepared statement when connecting to my database, and I do this because it is considered a safe way to do so, but one thing I could not help but to wonder was, can submitted data from ...
4
votes
2answers
2k views

How do I protect user data at rest?

I want to encrypt the username, email, and password fields in the database AND encrypt user files at rest. How can I do this? I am aware of software such as Gazzang and since there is not cost ...
4
votes
2answers
170 views

Is this a safe way to connect to a server

I am using a software to backup my website .sql data every 3 days and it connects simply to the server logs in and downloads the .sql file to my computer. While its downloading the connection is not ...
11
votes
4answers
934 views

Encrypting IP addresses in a MySQL database

I'd like to encrypt IP addresses in my MySQL database, with the following constraints: Does not need to be resistant to attackers that can execute queries. Must be resistant to attackers that have ...
1
vote
0answers
442 views

A proposal for Data Transmission and Password Encryption [closed]

I need to implement a sensitive data protection scheme which can meet the requirements on secure data transmission, protection and storage, assuming mutually trusted third party is not available, that ...
4
votes
6answers
7k views

Mysql - two-way encryption of sensitive data (email addresses) outside of Apache, PHP and MySQL

We store user email addresses in our database, like many other websites. While we do take pride in the security measures in place, sometimes "just enough" is just not enough. We've begun looking into ...
4
votes
2answers
3k views

Does mysql_escape_string have any security vulnerabilities if all tables using Latin1 encoding?

I have heard that the PHP function mysql_escape_string has security vulnerabilities related to mult-byte characters. Are there any vulnerabilities if all tables are using Latin1 encoding?