RE: [PHP-DB] Protecting database password

On Unix it is possible to make an include file with all the settings like $user, $passwd and so on and store it somewhere in the filesystem (not under your htdocs-path) So no one can access this file via web .... You can include this file with its variables with the include() - statement ... Imagine your PHP-Engine won´t work and someone accesses a page where you included this file with the settings .... he will never see your Password but just the include-statement ... nothing else ... And he won´t be able to access the file since its not in yout /htdocs - Path ... Cheers, Marcel > -----Original Message----- > From: Marco Draijer [SMTP:mdraijer@cgey.nl] > Sent: Wednesday, July 18, 2001 09:41 > To: php-db@lists.php.net > Subject: [PHP-DB] Protecting database password > > For a PHP-application on Windows NT, I am using an Oracle database and the > > database-interface db_oci8.inc (a PHP-class, downloaded from the net). > To be able to make the connection to the database, the class has to know > the > > databasename, username, and password. At the moment, it is hardcoded in > the > include-file. This file can be downloaded by anyone who knows its exact > name > and > location (which is not hard, of course). I want to prevent this. > I have tried some things with permissions, but I could not find a solution > > there. > A known solution on Windows-platforms is, to put the names & password in > the > > registry of the server, but I don't know how I can read data from the > registry > in PHP. > Another solution is to use environment variables. I know how to read them: > the > documentation says that getenv() gives the environment of the client, but > that > is not true, at least on NT it gives the environment of the server. But > then > > again: of which user is that environment and won't it be easy to read that > > environment over the internet? > Can anyone give me advice on this? > Furthermore I will be setting up a similar construction (PHP + password > protected database) on a Linux machine. So I am also interested in > Unix-only > > solutions. > > Thanks in advance, > Marco Draijer > > -- > ************************************************************************** > ** > This message contains information that may be privileged or confidential > and > is the property of the Cap Gemini Ernst & Young Group. It is only intended > for the person to whom it is addressed. If you are not the intended > recipient, you are not authorized to read, print, retain, copy > disseminate, > distribute, or use this message or any part thereof. If you receive this > message in error, please notify the sender immediately and delete all > copies > of this message. > ************************************************************************** > ** > > -- > PHP Database Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-db-unsubscribe@lists.php.net > For additional commands, e-mail: php-db-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net If you have received this e-mail in error or wish to read our e-mail disclaimer statement and monitoring policy, please refer to http://www.drkw.com/disc/email/ or contact the sender.