Re: Securing PHP code

For some people, putting information outside the docroot isn't possible, especially when your site is hosted. On thing you can also try (which is nowhere near the security of outside the docroot) is to put ocnfig data (user, pass, etc...) inside it's own php file that is included in outfiles. For example (assuming that php parser doesn't fail): ------ configstuff.php ---------- <?php $user = "myname"; $pass = "mypass"; $db = "mydb"; ?> ------ end ---------------------- - Edwin - wrote:

Hello, "Doug Essinger-Hileman" <greypilgrim@interior-castle.org> wrote:

On 25 Jun 2003 at 16:42, Dan Joseph wrote:

Store that file outside the docroot. That way there is no chance they can get it from the web site. I myself use an ini file that is no where near the docroot, and use parse_ini_file() to load the DB information in, and then I connect to it. This method passed our security audit with flying colors. A sample of what my ini file resembles is: [mysql_info] host = 192.168.1.1 uid = username pwd = password dbn = database They end up in a $INI array, and the fields are $INI['host'], $INI['uid'], etc.. You can read more about that function @ www.php.net.

I am just beginning to use php and mysql together (I'm new to both). I am having trouble getting this to work in what I think is a very simple test. I have created mysql.ini, and put it outside the docroot: /myhome/mysql.ini. This file, in its entirety, is: [mysql_info}

I think you meant [mysql_info]? (Check the closing bracket.)

host=spore.org uid=myuserid passwd=mypassword Then I created a webpage with nothing more than the following: <?php parse_ini_file("/home/revref/mysql.ini"); echo $INI; ?>

There's a good example in the manual: http://www.php.net/manual/en/function.parse-ini-file.php Notice that you need to do something like this: (based on your example) <?php $INI = parse_ini_file("/home/revref/mysql.ini"); print_r($INI); ?> - E - PS Please check the difference between print_r() and echo() as well... ...[snip]... __________________________________________________ Do You Yahoo!? Yahoo! BB is Broadband by Yahoo! http://bb.yahoo.co.jp/