Home/ Questions/Q 6752997
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T13:06:34+00:00

Sometimes when installing a new product on our web server, I noticed that the

  • 0

Sometimes when installing a new product on our web server, I noticed that the install managers (usually a simple HTML / PHP interface) automatically fill in our MySQL details in the form for setting up the database. The user and password are correct, but I never entered them myself.

If the software can do it, couldn’t a hacker possibly do the same? Do I need to take any additional preventive measures?

I have set the permissions so that no one except the designated users can execute those scripts, but it still left me wondering if it could be exploited somehow.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Your environment is possibly setting the mysql.default_user and mysql.default_password, which those install scripts may be looking at. Try running phpinfo() to determine the runtime configuration and see if these configuration options are set.

    Look at the PHP MySql Configuration Manual

    Whether you think any script having access to the MySql credentials is a risk depends on your environment. I’d probably err on the side of not having these options set, and not only because of the possible security implications.

    • 0