3

As you know, SQLite have no security mechanism. My question is if i change the database file into some random name like '22OYIz23tmpyesTcMVFmw1tquFxzCIQD.sqlite' can someone exploit my database and how?

Assuming that i have my own server, not shared host, the database is only accessed throught my web app(PHP)

  • 7
    That is a security through obscurity approach which is not that safe. This is said, your question is too broad: provide some details and say what are you trying to prevent. – user45139 Sep 30 '15 at 7:13
  • 1
    The server is using Linux. I don't know whether someone can know the database location and download it (which then can exploit my database). – Huynh Quang Sep 30 '15 at 7:17
  • 3
    Honestly, you should first investigate the capability of your chosen platform: apparently, your knowledge is inssuficient for any answer we can give you to make sense (that's why your question is too broad: you don't have the necessary basic). Start with understanding what functionality your OS, DB and web server provide you and then check on standard way to deploy the technology you chose. – Stephane Sep 30 '15 at 7:21
  • 1
6

SQLite is not like a traditional DBMS in that it does not serve the content of the database to a computer network. It is actually kinda like just storing everything in a file. SQLite is will then allow your application to load that file and query it.

As such there is no need or advantage to a user account system as only programs on the same computer can interact with it anyway. The OS's file permission system should provide protection against not authorized reading/writing. Of course the machine on which this system is located needs to be secured as anyone with appropriate access on this machine can read/edit the database.

If you for example want to be able to only read table A but read and write table B then you should use 2 database files, one with only read permissions and the other with read/write permissions. How you do this is OS dependent.

0

The database management system you are using have nothing to do with the fact that you could be compromised and your data stolen.

If someone can execute arbitrary commands through your PHP webservice, chances are that they can retrieve your website's sources and with it the name / IP / password of your database.

Based on this, you can choose whatever funny name you want, it won't matter. Eventually they will be able to exploit an existing connection without even knowing which type of database lies behind.

0

The short answer is no. All you’re doing is making the database file name hard to guess, but you’ve done nothing to actually hide it from users.

What you need to do is stop the server from serving the file to outside users.

There are two approaches to protecting your database file:

  • Set up .htaccess so that it never serves a file with the extension of your database file (typically .db or .sqlite). Since your PHP application accesses the file directly, it won’t be restricted access.

  • Put the database outside the web root. Remember that PHP has access to the whole filing system, and is not limited to the web root. You will, however, need to ensure that the database file has the appropriate owner and group permissions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.