Re: Password in connection string

Hiya, The problem is md5 is a hash and you need to be able to decrypt the password to connect to the database. You could store the password encrypted but your script would have to be able to decrypt the password, which means that you have to store the encryption key in your script at which point there is no security benefit in storing your password encrypted :). The same problems existing in putting the password in the my.cnf, it still has to be readable by the server which means that at the very least anyone else on the server that can execute their own scripts can read the file (write a script that reads the file as the webserver user). Not a lot of ways to increase the security other than running your own box or not using passwords for database connections which is less secure. Jason daniel@electroteque.org wrote:

i usually have connection settings within a file outside the web dir and include it that way so its lookes something like <? $pass = "pass"; $user = "user"; $database = "database"; $host = "localhost"; ?> what would be good is to even transfer the pass via md5 is there any possibilties ? maybe this is a mysql specific question

I'm using PEAR and a MySQL database. My connection string contains <user>:<password> and works fine. But I don't like having passwords in clear text. Is there any way for me to not have to code the password but instead let MySQL find it in a my.cnf file? I've tried with <user>=mysql, which is the owner of mysqld, and I've put the password in the [client] section of mysql's home directory. What's happening is that by omitting the password in the connection string, the connection is attempted with "using password=NO". This is unlike the behavior of other clients for mysql. Is there any way to do this? BTW, I've found one "solution" to be: put the setting of the connection string, which is a $_SESSION variable, in a file that's not in the document root, then REQUIRE that file. -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php