Re: private var in class

Hi, There are no "private" members in php classes. I also don't see how you can protect a password from being seen if you allow the class to be included -- if you have a "hostile" user on your machine they can open the file using "fopen" and read the contents, so even a "private" member would not protect the info (heck, even in a compiled binary with "real" private class members a simple program like "strings" could get the password). If you just want to avoid people inadvertently getting the password just by doing a "var_dump" or so, then put the password in the constructor and make your connection in the constructor; there's no point in making it a class member anyway as it is used only once (at least if you use persistent connections). Once someone has access to the database they can mess with the database anyway, regardless of password (if you use persistent connections), so you're best security is limiting each user to a different password and letting each user have his or her own password -- i.e., let your database manage the security (assuming you have a db which supports this). I would not rely on PHP protecting a password from users who have access to the server (at least if you are running virtual hosts and have multiple users in the same user/group space). Ciao, Andreas Pour Reuben D Budiardja wrote: > > Suppose I have a class: connect_db, and a variable $passwd, which I want to > be private in that class. > > What can I do to prevent someone do something like: > > $myApp = new connect_db(); > echo $myApp->passwd; > > I'm running Apache server with PHP 3.0.8, and indeed I can do that to > access variable in my API classes, which make it really vulnerable. Any > suggestion? is this problem fixed in php4? > > Thanks > Reuben D. Budiardja > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net