3

I looked at this question: What is the right way of storing database connection strings from the security point of view?

And I'm wondering specifically for connecting to a MySQL database with PDO, how can I be more secure?

  1. I currently store my password in plain text in a .php file.
  2. If storing outside the root is optimal, how can I include this file when I must access the database in index.php for example?
Community
  • 1
user1114
  • 145
  • 5

2 Answers2

3

Use include or include_once to include anything in PHP.

<?php
include_once("/etc/out-of-htdocs/password.php");
?>

The PHP code can access files, which are not accessible via an URL. That is the security benefit.

In case of a miss configuration of the PHP module it is possible that every PHP file gets delivered without evaluation, which means that the password is world readable for everybody. If the PHP file is not accessible via an URL a configuration problem of the PHP module does not have any impact in the password security.

ceving
  • 482
  • 2
  • 9
1

I want to add to the original question - maybe there is a way not to store the actual password in a file at all? Just to keep a hash in it so if the PHP files somehow are downloaded attacker can`t do that much.

I think it's not a farfetched example, because sometimes it's not possible to store configuration file away from the directory which is accessible via FTP which can be easy forced.

Hendrik Brummermann
  • 27,258
  • 6
  • 81
  • 121
Xenon
  • 11
  • 1
  • You can store the password e.g. in an environment variable reading it via the $_ENV array, so reading PHP code will not reveal the password, but if attacker is able to trigger a code execution, he can still access the password. – Krzysztof Kotowicz Jan 03 '12 at 00:59
  • Good point. Maybe, i can use something similar with encrypted RSA keys. Around the document root i store encrypted key, which is decrypted into memory (like ssh-agent). Password can be stored in memcached for example. This is more real. – Xenon Jan 03 '12 at 09:56
  • 1
    Using environment variables for secrets would generally be discouraged, because on many OSes a process's initial environment is readable to any user logged-in on the server. – bobince Jan 24 '12 at 08:11