Don Calfa wrote:
> Vaughn Treude wrote:
>
>> Hello all:
>> I know there are a lot of PHP gurus on this list, so hopefully it's
>> not too off-topic.
>> I'm a newbie to PHP and I'm struggling with a login script for my
>> organization's website. I'm using an example script I got off the
>> Web somewhere. It uses MySQL through the "PEAR" database driver.
>> Here's the code snippet for the connection code in db_connect.php:
>>
>> ---------------------------
>>
>> //require the PEAR::DB classes.
>>
>> require_once 'DB.php';
>>
>>
>> $db_engine = 'mysql';
>> $db_user = 'XXXX';
>> $db_pass = 'YYYYYYYY';
>> $db_host = 'ieeepacn.com';
>> $db_name = 'ZZZZZZZ';
>>
>> $datasource = $db_engine.'://'.
>> $db_user.':'.
>> $db_pass.'@'.
>> $db_host.'/'.
>> $db_name;
>>
>>
>> $db_object = DB::connect($datasource, TRUE);
>>
>> ------------------------
>>
>> This works, but it occurs to me: how can this thing possibly be
>> secure? The password's there in clear text. A person would only
>> need read access to get it. And if the PHP file's not globally
>> readable, the login fails. Is there some factor here I'm missing
>> such that it's more protected than I think? Or is there a better way
>> to approach this?
>>
>> Thanks!
>> Vaughn
>>
>>
>>
> 1. If the webserver parses PHP not as text, no one will be able to
> read the contents of the file from the browser.
> 2. You can create a user for MySQL that only has rights to the DB and
> not login to the server.
> 3. You can split the variables from the connection string into 2 files.
> 4. You can encrypt the variables (Like $db_pass = "cGFzc3dvcmQ="; in
> 1 file and in another file $db_engine =
> {...base64_decode($db_pass)...;}. (there are tons of ways to do this)
> 5. You can obfuscate the entire script (from:
> http://richard.fairthorne.is-a-geek.com/utils_obfuscate.php):
>
> <? eval(gzinflate(base64_decode('
> VY9NDoIwEEbXkHCHWZBUE1P2+IMheAGjibohpUwE
> Iy1QWHh7GaARv676pjPzGh1abPqyxVQricCSmNdF
> zbaeS8fPsxTVs1QIe2DVxzRvKhHuDbYEb0Msq4Ux
> xO5zLC+06YiXiFgLqbjUla0pUY3DH1OmzX4uOmF0
> 30qq/Sw4C4OAcc91HAfAagz0j5EGZ8eJwQzJgbOp
> GcA+pe2Lv+rshZJUkzgMpVZquK0WMhu4nK+n9dix
> i74=
> '))); ?>
>
> I use #2 and #3 and make sure only that permission is available from
> localhost for production. I sometimes use #5 in situations that I
> need to protect myself (the tinkerer that messes with the code then
> suddenly calls 'Hey, this doesn't work!').
>
> If anyone wants access to the DB, they'll get it. You just have to
> make it not easy.
>
>
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change you mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
That is a great tip, thanks!
JD
--
JD Austin
Twin Geckos Technology Services LLC
email:
jd@twingeckos.com
http://www.twingeckos.com
phone/fax: 480.344.2640
---------------------------------------------------
PLUG-discuss mailing list -
PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change you mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
(text/plain)