Best way to connect to MySQL with PHP securely

Question

I want some input on what you guys think is the most secure way to connect to a MySQL database using PHP. Currently the way I'm doing it is a utility PHP file that I include in the top of all my other PHP files. The utility PHP file is this:

<?php
    if(!defined('IN_PHP')){
        die("hackerssss");
    }
    $mysql_host = "localhost";
    $mysql_user = "root";
    $mysql_pass = "root";
    $mysql_db = cokertrading;
?>

Any suggestions?

You're missing quotes: `$mysql_db = "cokertrading"` (unless it's a constant). That `defined('IN_PHP')` check is not really useful here, as you're only defining variables, and not connecting immediately. — Lekensteyn, Sep 14 '10 at 15:51
@daniel the root/root is for testing on my local machine duh — Tim, Sep 14 '10 at 15:51
i love all the "if your user/pass are root/root then you're a dick" comments and answers. If you were going to post up php source about security you wouldn't put your ACCTUAL username and password in the post would you now? — Thomas Clayson, Sep 14 '10 at 15:52
@Daniel Vandersluis I wish I could vote up a comment more than once :) — UnkwnTech, Sep 14 '10 at 15:52
@Thomas I've seen people post their actual passwords on SO before...people make mistakes sometimes. — Daniel Vandersluis, Sep 14 '10 at 15:54
@daniel yes but cant be seen from the internet. This is not for real just a fun project. — Tim, Sep 14 '10 at 17:19
This whole question depends entirely on whether the database is on the same server as your web-server (apache etc). Until we get this we cannot give you an answer. — m.edmondson, Sep 14 '10 at 15:56

score 26 · Answer 1 · answered Sep 14 '10 at 15:49

26

Suggestion: You should probably never be running as root; create another account and give it the 'least' privileges required for your site.

answered Sep 14 '10 at 15:49

Alex

3,644
2
19
27

12

+1 for the "least privileges" approach. – Pekka Sep 14 '10 at 16:00
4

+1 for correcting using semi-colon; root is never a good idea. – matt_h Sep 16 '10 at 22:28
And then implement my solution ;p – Theodore R. Smith Nov 15 '12 at 22:54

score 9 · Answer 2 · answered Sep 14 '10 at 16:55

I can believe noone has mentioned MYSQLI and prepared statements yet, you may lock your password and database connection away, but thats ultimately futile if I can simply type ';DROP TABLE users;-- in the login form.

Check http://en.wikipedia.org/wiki/SQL_injection for an idea about what I'm talking about.

Pekka · Answer 3 · 2010-09-14T16:04:38.027

6

Define a pair of proper login credentials instead of "root/root" (change the user name to something else, and choose a complicated password);
if possible restrict access to the database to localhost on a firewall level or, as @Scott says in the comments, set mySQL to listen to connections from 127.0.0.1 only. If both is not possible, restrict access on mySQL level. ("username"@"localhost")

edited Sep 14 '10 at 16:04

answered Sep 14 '10 at 15:50

Pekka

442,112
142
972
1,088

The firewall rules aren't a bad idea, but they're unnecessary. You can accomplish the same by changing the mysql config to only listen on 127.0.0.1 – Scott Arrington Sep 14 '10 at 15:51
Unless cokertrading is defined as a constant somewhere else in the file. – UnkwnTech Sep 14 '10 at 15:52
@Scott good point. @Unknwntech yup, it's not sure. Removed. – Pekka Sep 14 '10 at 15:52
+1 for restricting access to the local machine. – Daniel Vandersluis Sep 14 '10 at 15:56

score 5 · Answer 4 · edited Dec 03 '17 at 11:25

5

Because PHP scripts are server side - i.e. they are parsed on the server and only the output is sent to the browser - the way you are doing this is perfectly secure.

The only way that people would be able to get your username and password would be to actually hack into your server and view the source code - in which case there's no way (in PHP) to protect against this.

edited Dec 03 '17 at 11:25

Peter Mortensen

30,738
21
105
131

answered Sep 14 '10 at 15:50

Thomas Clayson

29,657
26
147
224

score 5 · Answer 5 · edited Dec 03 '17 at 11:26

5

Remember that anyone who can read that file will know your SQL password: set it not readable by others.
Don't login with root: create a user for each application.
Don't use "root" as your root password.
Don't give your password to everyone.

edited Dec 03 '17 at 11:26

Peter Mortensen

30,738
21
105
131

answered Sep 14 '10 at 15:51

o0'.

11,739
19
60
87

Best way to connect to MySQL with PHP securely

5 Answers5

Linked