MySQL is an open-source relational database management system.
9
votes
2answers
3k views
where to store a key for encryption
I am looking for a way to store a key used for password encryption. I am using a mysql db which would store a user name and an encrypted password that would be encrypted using ...
17
votes
2answers
2k views
MySQL Server Hardening
Following the hardening theme....
What are some best practices, recommendations, required reading for securing MySQL.
11
votes
2answers
2k views
Multibyte character exploits - PHP/MySQL
Could someone please point me to a link with some information on multibyte character exploits for MySQL? A friend brought them to my attention, but I've not been able to find much information on the ...
15
votes
3answers
1k views
MySQL OLD_PASSWORD cryptanalysis?
The password hash used for MySQL passwords prior to version 4.1 (now called OLD_PASSWORD()) seems like a very simple ad-hoc hash, without salts or iteration counts. See e.g an implementation in ...
4
votes
5answers
4k views
Mysql - two-way encryption of sensitive data (email addresses) outside of Apache, PHP and MySQL
We store user email addresses in our database, like many other websites. While we do take pride in the security measures in place, sometimes "just enough" is just not enough.
We've begun looking into ...
16
votes
7answers
818 views
How would you exploit this vulnerability in order to cause max damage
I've found a whole lot of SQL injection exploits in some systems I maintain. I know how to prevent the injection, but I would like to demonstrate to my CEO and CTO how dangerous it is if we don't have ...
4
votes
1answer
471 views
Is this admin area secure enough? V2
This is a response to my previous question, Is this admin area secure enough?.
There were some very helpful answers there, for which I am very grateful. So I went back to the drawing board and here ...
4
votes
2answers
366 views
Is it a secure way to declare DB parameters in htaccess rather than in a PHP file?
It has been suggested in securing PHP article that using directive as below in htaccess is more secure than hardcoding it into your app:
<VirtualHost ilia.ws>
Include /home/ilia/sql.cnf
...
37
votes
5answers
2k views
Password security in databases - today still best practice? [duplicate]
Possible Duplicate:
Which password hashing method should I use?
There are a ton of great posts about password security in databases on stack overflow and on other sites and as I am ...
4
votes
3answers
316 views
Is it secure to centralize database information?
I would know if it is secure to centralize database information into one file like this :
db_infos.php:
$server = "localhost";
$user = "root";
$password = "1234";
$database = "foo";
$table = "bar";
...
4
votes
2answers
2k views
mysql AES_ENCRYPT key length
AES_ENCRYPT uses a 128 bit long key to encrypt the data, but how does mysql handle longer or shorter keys? I found out that pycrypto for instances recomend to transform the key by using md5 sha1 sha2, ...
3
votes
3answers
317 views
Is this admin area secure enough?
EDIT: Please view the revised question instead
The admin area has special access to the database (modifying orders, etc).
To help explain, I drew a diagram, so here is my process:
Notes:
I ...
2
votes
1answer
706 views
How to secure MySQL based web session data table?
I have the following MySQL session schema:
CREATE TABLE `SessionData` (
`id` varchar(50) COLLATE utf8_unicode_ci NOT NULL,
`data` text COLLATE utf8_unicode_ci,
`date` datetime DEFAULT NULL,
...
