Question

First time reader, first time poster (woo!)

So I’ve been implementing my login scripts for an informal website. Not likely to be compromised, but just to be safe, I’d like to ask if there’s a security risk in having my MySQL database login stored in plaintext in the php code.

As far as I know, the code itself is parsed by Apache, so the end-user doesn’t see it (just the output), which would mean it should be safe to keep… but I’d like a second opinion.

Summary:
Accessing database through mysql_connect, mysql_select_db, mysql_query. Login info stored in local variables defined at each iteration of the script, and (I think) dumped once script terminates.

Security vulnerability?

Answer 1

You could also consider moving the username/password combination to a seperate configuration file that lives outside the webroot. Make sure that place is not directly accessible from the webserver side.

That way, if for some reason the webserver decides not to execute PHP files anymore you don’t lose the account information to the database server.

As an added bonus, if you use anything that makes a copy of the .php file (editors, SVN or whatever) in the webroot, you don’t risk anyone getting around the .php execution.