SitePoint Sponsor

User Tag List

Results 1 to 9 of 9
  1. #1
    SitePoint Wizard DoubleDee's Avatar
    Join Date
    Aug 2010
    Location
    Arizona
    Posts
    3,764
    Mentioned
    2 Post(s)
    Tagged
    0 Thread(s)

    Are Constants Safe?

    Are Constants a safe place to store things like the Administrator's E-mail Address?

    I am looking for a way to streamline my PHP Error-Handling, and would like to have One Variable/One Place where I can store things like the Admin's E-mail.

    If I put it into a PHP Constant, then it would accessible to all of my scripts, which seems like a good thing. However, maybe that is bad from a *security* standpoint?!

    Thoughts?

    Sincerely,


    Debbie

  2. #2
    ¬.¬ shoooo... silver trophy logic_earth's Avatar
    Join Date
    Oct 2005
    Location
    CA
    Posts
    9,013
    Mentioned
    8 Post(s)
    Tagged
    0 Thread(s)
    There is nothing secure or insecure about using a constant over a variable or anything else. IT DOES NOT MATTER, concerning security. Whether you use a constant or variable, both would be accessible to any and every scripted that included them. The only difference between constants and variables, constants are read-only.
    Logic without the fatal effects.
    All code snippets are licensed under WTFPL.


  3. #3
    SitePoint Wizard DoubleDee's Avatar
    Join Date
    Aug 2010
    Location
    Arizona
    Posts
    3,764
    Mentioned
    2 Post(s)
    Tagged
    0 Thread(s)
    Quote Originally Posted by logic_earth View Post
    There is nothing secure or insecure about using a constant over a variable or anything else. IT DOES NOT MATTER, concerning security. Whether you use a constant or variable, both would be accessible to any and every scripted that included them. The only difference between constants and variables, constants are read-only.
    If Constants are read-only, then you could argue they are slightly more secure, because a hacker could not change their values, right?

    Would there be any benefit to storing something like an Admin's E-mail in the database instead? (Almost like you would access a security key...)


    ------
    Back to my original question...

    How do you handle things like Admin e-mails?

    Do you store them in Constants in a "config" file, or something else?

    Thanks,


    Debbie

  4. #4
    Utopia, Inc. silver trophy
    ScallioXTX's Avatar
    Join Date
    Aug 2008
    Location
    The Netherlands
    Posts
    9,067
    Mentioned
    153 Post(s)
    Tagged
    2 Thread(s)
    Quote Originally Posted by DoubleDee View Post
    Would there be any benefit to storing something like an Admin's E-mail in the database instead? (Almost like you would access a security key...)
    A serious drawback about that approach is that you can't email the admin when the database is down, because you don't know his/her email address ...

    And yes, most projects/frameworks I've seen use some sort of config file for stuff like that.
    Rémon - Hosting Advisor

    SitePoint forums will switch to Discourse soon! Make sure you're ready for it!

    Minimal Bookmarks Tree
    My Google Chrome extension: browsing bookmarks made easy

  5. #5
    ¬.¬ shoooo... silver trophy logic_earth's Avatar
    Join Date
    Oct 2005
    Location
    CA
    Posts
    9,013
    Mentioned
    8 Post(s)
    Tagged
    0 Thread(s)
    Quote Originally Posted by DoubleDee View Post
    If Constants are read-only, then you could argue they are slightly more secure, because a hacker could not change their values, right?
    If an attacker has managed enough to be able to access your PHP files, they can change them by simply rewriting the source code. It really is not that hard. Like it I said, there is no security advantage over a constant or variable.
    Logic without the fatal effects.
    All code snippets are licensed under WTFPL.


  6. #6
    Certified Ethical Hacker silver trophybronze trophy dklynn's Avatar
    Join Date
    Feb 2002
    Location
    Auckland
    Posts
    14,653
    Mentioned
    19 Post(s)
    Tagged
    3 Thread(s)
    DD,

    Despite your responses, if you place your constants.php file OUTSIDE your web space, the hackers would have to break into your account, not just the website, to gain access to that information. Consider placing your database constants there, too.

    Regards,

    DK
    David K. Lynn - Data Koncepts is a long-time WebHostingBuzz (US/UK)
    Client and (unpaid) WHB Ambassador
    mod_rewrite Tutorial Article (setup, config, test & write
    mod_rewrite regex w/sample code) and Code Generator

  7. #7
    SitePoint Wizard DoubleDee's Avatar
    Join Date
    Aug 2010
    Location
    Arizona
    Posts
    3,764
    Mentioned
    2 Post(s)
    Tagged
    0 Thread(s)
    Quote Originally Posted by dklynn View Post
    DD,

    Despite your responses, if you place your constants.php file OUTSIDE your web space, the hackers would have to break into your account, not just the website, to gain access to that information. Consider placing your database constants there, too.

    Regards,

    DK
    Ah, yes, that is a good reminder!

    Okay, so some follow up questions...

    1.) If I have a Linux VPS with "root" access - or I switch to "Managed Dedicated Linux Server" where someone else has "root" access, then in general terms, how hard is it to set up a Directory and Access outside of my base Web Root?

    2.) If I do #1, am I avoiding one issue, but perhaps opening myself up to other issues (because maybe enabling things is harder than a NON-Linux Sys Admin like me can handle?!

    3.) How much extra security do you gain by not only removing things like "config" files and "database settings" files from your Web Root, but placing them on a separate Linux VPS or "Managed Dedicated Linux Server"?

    Thanks,


    Debbie

  8. #8
    Certified Ethical Hacker silver trophybronze trophy dklynn's Avatar
    Join Date
    Feb 2002
    Location
    Auckland
    Posts
    14,653
    Mentioned
    19 Post(s)
    Tagged
    3 Thread(s)
    DD,

    1. No need for dedicated nor VPS as even shared accounts have files above their DocumentRoot. Remember, http://domain/users/~username/public_html (or www)? Merely stay in the ~username directory (better, create a subdirectory there at the same level as public_html) and link to your config files there. They can only be accessed by PHP or by FTP access with YOUR credentials.

    2. That's harder than a non-sysAdmin? I don't think so as that's how a webmaster would do it.

    3. How much extra security? Not much IF you are using a strong password, you are not allowing uploads of scripts (especially PHP scripts) and are following other strong security measures. However, those constants and other configuration settings will be UNAVAILABLE via HTTP. That's got to be worth something ... if you're as paranoid as I am.

    Regards,

    DK
    David K. Lynn - Data Koncepts is a long-time WebHostingBuzz (US/UK)
    Client and (unpaid) WHB Ambassador
    mod_rewrite Tutorial Article (setup, config, test & write
    mod_rewrite regex w/sample code) and Code Generator

  9. #9
    SitePoint Author silver trophybronze trophy
    wwb_99's Avatar
    Join Date
    May 2003
    Location
    Washington, DC
    Posts
    10,629
    Mentioned
    4 Post(s)
    Tagged
    0 Thread(s)
    Not so fast. If an attacker can compromise things to the point they can get into the server-side script in your PHP files, they can certainly start walking the directory tree and getting at things outside the webroot. Unless you've jailed the web process so it can't escape said webroot and then you can't use includes outside the webroot.

    Logic_earth has it exactly right -- there is no effective security difference between a constant and a variable. IIRC, PHP constants aren't really all that constant anyhow, you can re--DEFINE() if need be.


Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •