SitePoint Sponsor

User Tag List

Results 1 to 12 of 12
  1. #1
    SitePoint Enthusiast Fallen Angel's Avatar
    Join Date
    Sep 2006
    Location
    UK
    Posts
    76
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Database connection security

    I'm working on a small database to display information (MySQL and PHP) on a site I'm working on, and the database itself is working fine (small miracle! ). My question though is about security.

    I've not yet got to the stage where I've got the display sorted out on the site itself, but I've got the pages set up for adding data, editing data, viewing the records, and deleting records. Obviously in addition to the pages for handling the data, there's also a page for the connection details, in the usual format:

    PHP Code:
    <?php
    $hostname
    ='localhost'
    $user='******'
    $pass='*******'
    $dbase='********'
    $connection mysql_connect("$hostname"$user"$pass"
    or die (
    "Can't connect to MySQL");
    $db mysql_select_db($dbase $connection) or die ("Can't select database.");
    ?>
    Obviously security's important (adding data to the database isn't too much of a problem as I or one of the site's team will be inputting the data and the pages will be in a password protected directory), and according to my MySQL book (I'm not practised enough at it yet to be able to do it without frequent referring to my book) I need to secure the connection details. It doesn't really go into any details about how to do that though.

    From looking around online for details of how to secure connection details some places suggest keeping the file with the connection details outside of the web root where it's not publicly accessible. Another said that as the file's a PHP file and therefore processed server-side, the PHP won't be viewable via a browser so it's safe to leave the connection file in the site's main directory. Another said that it's safe to leave it in the web root but the file should be chmodded so it's not readable (but not what it should be chmodded to). I'm confused!

    From my previous experiences with scripts, whenever a script's suggested that some element should be outside the web root, I've been unable to get it to work with connection details outside the web root (the last time I tried it was a database backup script that was supposed to run a cron job to backup, but while the script ran with all the files in the web root, when I moved the connection details, nothing).

    Could anyone offer any advice please?
    "You don't need eyes to see - you need vision"
    ecanus.net: Poetry, smileys and stuff

  2. #2
    SitePoint Wizard
    Join Date
    Mar 2002
    Location
    Bristol, UK
    Posts
    2,240
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    If you store the details outside the web root you'll obviously have to update the scripts that refer to its old location to reflect its new location.

    PHP files are processed server side, and you're right that the PHP code inside (including your connection details) will not be displayed when requested by a browser... except if there is a server error and the PHP parser crashes and outputs plain text for some reason. Unlikely, but not really a risk worth taking.

    If you're having trouble moving your connection details outside the web root, give us more information about what you're doing and what errors you're getting and we'll get it sorted for you

  3. #3
    SitePoint Enthusiast Fallen Angel's Avatar
    Join Date
    Sep 2006
    Location
    UK
    Posts
    76
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Thanks for that.

    I thought I was going to have trouble getting this to work (as I've never managed to successfully figure out the right path to folders outside the web root), and my first attempt using "/home/pmlryjdg/admins/connect.php", based on the path given for the home directory on my cPanel failed with a load of include "failed to open stream" error messages.

    Fortunately though after a quick google and a quick read of a few questions on various fora about include paths for folders outside web roots, I remembered that $_SERVER['DOCUMENT_ROOT'] is the variable for the document root. "$_SERVER['DOCUMENT_ROOT']/../admins/connect.php" (I think it was that) did actually work (yay!), but then I made the mistake of password protecting the folder with the database files for adding/editing/deleting and despite the files being there on the server, when I tried to browse to any of them, I didn't get the username and password popup, just a 404 page. I took the password protection off and it worked again, but then somewhere along the way with fiddling, it's suddenly decided there's an error on the include line of the file.

    This is the line for the include:

    PHP Code:
    include("$_SERVER['DOCUMENT_ROOT']/../admins/connect.php"); 
    I can't see what the problem is with it at all, but this is the error message I'm getting:

    Code:
    Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in /home/pmlryjdg/public_html/bookstall/dbadmin/index_mem.php on line 10
    (line 10 is the include line). I'm obviously missing something that's probably really simple, but I can't see anything at all.

    Has anyone any idea what the problem with this line might be?
    "You don't need eyes to see - you need vision"
    ecanus.net: Poetry, smileys and stuff

  4. #4
    . shoooo... silver trophy logic_earth's Avatar
    Join Date
    Oct 2005
    Location
    CA
    Posts
    9,013
    Mentioned
    8 Post(s)
    Tagged
    0 Thread(s)
    Quote Originally Posted by Fallen Angel View Post
    I'm working on a small database to display information (MySQL and PHP) on a site I'm working on...
    Just out of interest, if the need is small why not use Sqlite?
    Logic without the fatal effects.
    All code snippets are licensed under WTFPL.


  5. #5
    SitePoint Wizard bronze trophy
    Join Date
    Jul 2008
    Posts
    5,757
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Quote Originally Posted by Fallen Angel View Post
    Has anyone any idea what the problem with this line might be?
    http://www.php.net/manual/en/languag...parsing.simple

    They mention it will result in a parse error in the examples.

  6. #6
    SitePoint Enthusiast Fallen Angel's Avatar
    Join Date
    Sep 2006
    Location
    UK
    Posts
    76
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Thanks for the advice guys. I've finally got it sussed.

    The weird thing is that the previous approach worked the first time I tried it (before I started messing around with password protecting the folder the database admin pages are in), but I obviously changed something between that first time and subsequent times. I tried escaping various things, the double quote marks, single ones, the ".." to take the path one level above the document root, and every time I got a slightly different version of the error messages, but they were all basically about the syntax, or I was escaping characters that were changing the file path and changing it so that the file path was pointing to a location below the web root.

    This finally worked though:

    PHP Code:
    require_once('/home/pmlryjdg/admins/connect.php'); 
    "You don't need eyes to see - you need vision"
    ecanus.net: Poetry, smileys and stuff

  7. #7
    SitePoint Enthusiast Fallen Angel's Avatar
    Join Date
    Sep 2006
    Location
    UK
    Posts
    76
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    I've got this sorted now, with the database connection details in a directory above the web root. My db admin pages are in a password protected directory, but of course on the page where the data from the database is displayed on the site, the file with the database connection details has to be included for the script to be able to connect to the database.

    It seems a bit strange therefore going to the trouble of keeping the database connection details out of the way where no-one can get to them when the file with the connection details needs to be included on all the pages that require a connection to the database, because that means the connection details are part of the page again once the file's included.

    Is this the only way of doing it, and is there any way of making the details more secure? Or am I worrying unnecessarily? It's just occurred to me that while the PHP code won't be displayed when the page is requested by a browser, would that mean that if there was a server error and PHP parser crashed the file wouldn't be included anyway, so even if the server outputted plain text for some reason the connection details still wouldn't be visible? Just trying to get it straight in my head.
    "You don't need eyes to see - you need vision"
    ecanus.net: Poetry, smileys and stuff

  8. #8
    SitePoint Wizard silver trophybronze trophy Cups's Avatar
    Join Date
    Oct 2006
    Location
    France, deep rural.
    Posts
    6,869
    Mentioned
    17 Post(s)
    Tagged
    1 Thread(s)
    Have a good read of the ini file around the include_path setting.

    Find out what your include_paths are.
    PHP Code:
    echo ini_get("include_path") ; 
    Put your db connections file in there.

    Then call them nice and simply like this:
    PHP Code:
    <?php

    include 'database.php' ;

    ?>
    Avoid for as long as you can the need to specify paths.

    At a pinch put a directory in your include_path folder(s) called /connections

    and include your database connections like so:

    include 'connections/my_db.php';

  9. #9
    SitePoint Enthusiast Fallen Angel's Avatar
    Join Date
    Sep 2006
    Location
    UK
    Posts
    76
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Thanks - I'll check that out.
    "You don't need eyes to see - you need vision"
    ecanus.net: Poetry, smileys and stuff

  10. #10
    SitePoint Enthusiast Fallen Angel's Avatar
    Join Date
    Sep 2006
    Location
    UK
    Posts
    76
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Sorry for being a bit dense, but I've checked out the php ini file, and it appears that the include path is

    Code:
    .:/usr/lib/php:/usr/local/lib/php
    (that's the value in the ini file anyway) but I can't find that on the server with my FTP client.
    "You don't need eyes to see - you need vision"
    ecanus.net: Poetry, smileys and stuff

  11. #11
    SitePoint Wizard silver trophybronze trophy Cups's Avatar
    Join Date
    Oct 2006
    Location
    France, deep rural.
    Posts
    6,869
    Mentioned
    17 Post(s)
    Tagged
    1 Thread(s)
    Sounds like a permissions problem to me.

    Well, you can override that setting in a few other places.

    Take a look in ini_set and check the Appendix to see where you can override it, but overall, contact your hosting co and ask if their distro supports multiple php.ini files, or if that one is yours, that you have permission to access it.

    Be aware that changing the ini file necessitates a (web) service restart each time.

    If you are on shared hosting this is unlikely to be allowed.

  12. #12
    SitePoint Enthusiast Fallen Angel's Avatar
    Join Date
    Sep 2006
    Location
    UK
    Posts
    76
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Quote Originally Posted by Cups View Post
    Sounds like a permissions problem to me.

    If you are on shared hosting this is unlikely to be allowed.
    Yep, I'm on shared hosting. I'll have a word with them anyway and see what they say.
    "You don't need eyes to see - you need vision"
    ecanus.net: Poetry, smileys and stuff


Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •