Menu
Community /Pin to ProfileBookmark
@NogDogOct 28.2006 — #As far as DB connection data, I normally put it into an include file. That include file is saved outside of the web-accessible directory tree (e.g.: if my web document root directory is /home/nogdog/public_html/, then I might save it in a /home/nogdog/include/ directory). Then just add that directory to your include_path (either in php.ini or a .htaccess file) and include/require that file when you need to set your database connection values.
The include file might look something like:
Then in your script:
Also, note that the database user you specify should only have just enough permissions to do what needs to be done in your script. For instance, you may want to only give it select, insert, and update permissions limited to specific tables.
database security
I’ve been working on something that is just going to be used internally, so to make things easier I’ve been passing the database connection info (username, password, etc) to a session and just calling the session variables on each php page, but I want to change that since it’s probably a bad practice to get into since it’s info that a user would be able to view if they knew what to look for.
How do you normally hide this info?
also what software are you guys using for php development, I’ve been using Dev-PHP IDE I found on sourceforge but was curious what else was decent.
Sign in
to post a comment14 Comments(s) ↴
0
@NogDogOct 28.2006 — #As far as DB connection data, I normally put it into an include file. That include file is saved outside of the web-accessible directory tree (e.g.: if my web document root directory is /home/nogdog/public_html/, then I might save it in a /home/nogdog/include/ directory). Then just add that directory to your include_path (either in php.ini or a .htaccess file) and include/require that file when you need to set your database connection values.The include file might look something like:
[code=php]
<?php
define('DB_HOST', 'localhost');
define('DB_USER', 'abcd1234');
define('DB_PWD', 'Ab12Cd34');
define('DB_NAME', 'my_database');
?>
[/code]Then in your script:
[code=php]
<?php
require_once "my_include_file.php";
$connx = mysql_connect(DB_HOST, DB_USER, DB_PWD) or die("DB connection error");
mysql_select_db(DB_NAME) or die("DB select: ".mysql_error());
?>
[/code]Also, note that the database user you specify should only have just enough permissions to do what needs to be done in your script. For instance, you may want to only give it select, insert, and update permissions limited to specific tables.