mysql php security

Question

On my php pages, at the top i connect to the database like this

$db = mysql_connect("mysql.site.com","thedb", "pass"); 
mysql_select_db("dbase",$db);

Is this secure? Could someone somehow scan and view my code, therefore get access to the database?

UPDATE

Reason I ask is because a user was able to get access to my database, and im pretty sure it wasn't through sql injection.

Now that we are on the topic of security, generally you shouldn't use mysql_connect(), but instead use PDO and prepared statements. It is much easier to accidentally create code that's vulnerable to SQL injections when you don't use prepared statements. — kba
– kba, Commented May 27, 2012 at 17:10
It is worth noting that just this month (May 2012), a new vulnerability was publicly announced (and fixed in 5.3.13 / 5.4.3) that discloses PHP source code (and worse). thehackernews.com/2012/05/un-patched-php-cgi-remote-code.html — Cheekysoft
– Cheekysoft, Commented May 28, 2012 at 11:21

lanzz · Accepted Answer · 2012-05-27 17:05:02Z

3

It would be better if you move this snippet to an include file outside of your document root — this will prevent people reading it in case your webserver somehow gets misconfigured and starts serving PHP files as plain text. Although, just by itself, it is secure enough — it is unlikely that somebody will be able to misconfigure your server like this on purpose.

answered May 27, 2012 at 17:05

lanzz

43.4k12 gold badges93 silver badges99 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Rich Bradshaw · Accepted Answer · 2012-05-27 17:06:35Z

1

If someone did have access to your code, then yes, they would be able to read the password out.

There isn't a huge amount you can do about this, but ensuring that this code is a directory up from your web root would help.

(i.e. if you are serving your site from the folder /usr/htdocs/mysite, change it to /usr/htdocs/mysite/public, then put your includes in mysite rather than public.)

answered May 27, 2012 at 17:06

Rich Bradshaw

73.3k46 gold badges190 silver badges241 bronze badges

Comments

Gumbo · Accepted Answer · 2012-05-27 17:27:54Z

1

You should always apply multiple layers of defense:

Remove the credentials from the source code and place them outside the web server’s document root.
Restrict access to your database, possibly only via localhost or via socket.
Restrict the user’s privileges to only those necessary.

answered May 27, 2012 at 17:27

Gumbo

657k112 gold badges792 silver badges852 bronze badges

Comments

jcho360 · Accepted Answer · 2012-05-27 17:08:19Z

0

That's ok, the important thing I could say, go to your database and give to that user restricted permission, I mean only select, insert , update and delete the tables that it need.. beside that, create a file with that info and just include when you need it, that's my advice.

If someone go through your code will be able to see that info, but try to reduce always the damage impact

answered May 27, 2012 at 17:08

jcho360

3,7491 gold badge18 silver badges25 bronze badges

Collectives™ on Stack Overflow

mysql php security

UPDATE

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

UPDATE

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related