Question

Sometimes I get this on my webserver log:

[09-Dec-2012 15:35:45 Europe/Berlin] PHP Warning: mysql_query() [function.mysql-query]: Access denied
for user ‘root’@’localhost’ (using password: NO) in /bar/foo.php on
line 4

line 4 is:

$sql=mysql_query("select * from mytablefoo ORDER BY id DESC LIMIT 9");

It looks like somebody is trying to log in using a default root username.
Any way to prevent this, even if it’s not harmful?
How does he manage to connect through that line of code?

Thanks

Answer 1

Here is what I think is happening.

You have one page (e.g.: index.php) that includes a second page (e.g.: /bar.foo.php). On the index.php, you make the primary connection:

<?php
//  index.php
//  ...
$db = mysql_connect($db, $username, $password);
//  ...

On the second page, you do some function:

<?php
//  /bar/foo.php
//  ...
mysql_query("select * from mytablefoo ORDER BY id DESC LIMIT 9"); // TODO: use mysqli or PDO here
//  ...

However, there is no database connection if you visit the second file directly, so it tries connecting with default credentials, fails, and throws an error.

If you want to prevent this, then you need to secure your site. My guess is that people should never be allowed in your /bar folder. You can prevent people from entering this folder by adding an .htaccess file to this folder.

.htaccess files let you control how users can interact with file on your site. Just create a new text file, and save it as .htaccess (this file doesn’t have anything before the .).

Put this file inside of your /bar folder, and put the following text inside the file:

deny from all

Now, if anyone tries to visit this folder directly, they will be shown a 403 error message instead. The PHP files can still be included by other pages.

You can learn more about .htaccess here:

http://perishablepress.com/stupid-htaccess-tricks/