As you know, SQLite have no security mechanism. My question is if i change the database file into some random name like '22OYIz23tmpyesTcMVFmw1tquFxzCIQD.sqlite' can someone exploit my database and how?
Assuming that i have my own server, not shared host, the database is only accessed throught my web app(PHP)
SQLite is not like a traditional DBMS in that it does not serve the content of the database to a computer network. It is actually kinda like just storing everything in a file. SQLite is will then allow your application to load that file and query it.
As such there is no need or advantage to a user account system as only programs on the same computer can interact with it anyway. The OS's file permission system should provide protection against not authorized reading/writing. Of course the machine on which this system is located needs to be secured as anyone with appropriate access on this machine can read/edit the database.
If you for example want to be able to only read table A but read and write table B then you should use 2 database files, one with only read permissions and the other with read/write permissions. How you do this is OS dependent.
The database management system you are using have nothing to do with the fact that you could be compromised and your data stolen.
If someone can execute arbitrary commands through your PHP webservice, chances are that they can retrieve your website's sources and with it the name / IP / password of your database.
Based on this, you can choose whatever funny name you want, it won't matter. Eventually they will be able to exploit an existing connection without even knowing which type of database lies behind.
The short answer is no. All you’re doing is making the database file name hard to guess, but you’ve done nothing to actually hide it from users.
What you need to do is stop the server from serving the file to outside users.
There are two approaches to protecting your database file:
Set up .htaccess so that it never serves a file with the extension of your database file (typically .db or .sqlite). Since your PHP application accesses the file directly, it won’t be restricted access.
Put the database outside the web root. Remember that PHP has access to the whole filing system, and is not limited to the web root. You will, however, need to ensure that the database file has the appropriate owner and group permissions.
