Home/ Questions/Q 509445
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-13T07:00:41+00:00

First off, I realize that there is no such thing as a perfectly secure

  • 0

First off, I realize that there is no such thing as a perfectly secure solution (and even if there were, its usability would be crap).

That said, how do you protect your MySQL database from being compromised by someone downloading your code and picking through it? Based on my experience with PHP, it seems obligatory to store it within the code at some point or another, which sends up flags for me. I can see where refactoring to obfuscate variable, constant, and (user-defined) function names could be beneficial, but in the end it’d still be possible to trace through it and find the file with the DB login information.

Ideas?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Usually the MySQL auth information is stored in an external configuration file. The MySQL user used by the web-based app is given limited permissions such as SELECT, INSERT, UPDATE, DELETE and not given permissions such as ALTER, DROP, DELETE. If you want to release the code to the public you would not include your private config file, but a generic/instructional/minimal config file instead.

    Storing the MySQL auth info in an encrypted format is somewhat silly, as you’d need to store the private key / unencryption locally as well. If it is trivial for an unauthenticated user to view the code or configuration files on your server the problem isn’t the code – it’s your server setup & config.

    • 0