Question

When it comes to programming your web application in php, what is the most efficient way to prevent your MySQL information from being disclosed or discovered by another person (third party)? The information would include domain names and log in and passwords used in the connet functions.

For an example a good procedure might be keeping your mysql connection functions in a separate php file, etc.

Any ideas?

Answer 1

1. Keep your credentials in a separate .php file outside the document root (so it is not directly accessible over the web)
2. It is better to keep it a .php file instead of, say, .inc, so that even if it is accidentally accessible over the web, it will be executed and not displayed directly
3. Do not keep the username and password after you have established the connection (i.e., unset the vars or array keys holding the credentials after you don’t need them anymore); you cannot accidentally expose what you don’t have anymore
4. Do not allow repeated inclusion of the credentials file (e.g. if (defined('DB_AUTH_LOADED')) return; define('DB_AUTH_LOADED', 1); in your credentials file), in order to avoid any possible redefinition of your credentials vars

This should protect you from direct access to your credentials and from accidental leaks of the credentials by your own code. If attackers can upload PHP files to your server and manage to actually execute them, the fight is pretty much lost, but the above measures should keep you fairly safe from accidentally revealing your creds yourself.