Re: Password in connection string

no what i mean was maybe mysql can read in an md5 password , or store the user with an md5 password , and thats why i said maybe this was a mysql question > Hiya, > > The problem is md5 is a hash and you need to be able to decrypt the > password to connect to the database. > > You could store the password encrypted but your script would have to be > able to decrypt the password, which means that you have to store the > encryption key in your script at which point there is no security > benefit in storing your password encrypted :). > > The same problems existing in putting the password in the my.cnf, it > still has to be readable by the server which means that at the very > least anyone else on the server that can execute their own scripts can > read the file (write a script that reads the file as the webserver > user). > > Not a lot of ways to increase the security other than running your own > box or not using passwords for database connections which is less > secure. > > Jason > > daniel@electroteque.org wrote: > >> i usually have connection settings within a file outside the web dir >> and include it that way so its lookes something like >> >> <? >> $pass = "pass"; >> $user = "user"; >> $database = "database"; >> $host = "localhost"; >> ?> >> >> what would be good is to even transfer the pass via md5 is there any >> possibilties ? maybe this is a mysql specific question >> >> >>>I'm using PEAR and a MySQL database. My connection string contains >>><user>:<password> and works fine. But I don't like having passwords >>>in clear text. Is there any way for me to not have to code the >>>password but instead let MySQL find it in a my.cnf file? >>> >>>I've tried with <user>=mysql, which is the owner of mysqld, and I've >>>put the password in the [client] section of mysql's home directory. >>>What's happening is that by omitting the password in the connection >>>string, the connection is attempted with "using password=NO". This is >>>unlike the behavior of other clients for mysql. >>> >>>Is there any way to do this? >>> >>>BTW, I've found one "solution" to be: put the setting of the >>>connection string, which is a $_SESSION variable, in a file that's not >>>in the document root, then REQUIRE that file. >>> >>> >>> >>>-- >>>PHP General Mailing List (http://www.php.net/) >>>To unsubscribe, visit: http://www.php.net/unsub.php >> >> >> >> >>