Re: How can I secure database passwords used by PHP webpages
| From: | Dan Tappin | Date: | Wed, 02 Mar 2005 15:31:36 +0000 |
| Subject: | Re: How can I secure database passwords used by PHP webpages | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-209800@lists.php.net to get a copy of this message | ||
The best way is to not store the password at all.
Store a hash of the password like this:
INSERT INTO users SET pass = MD5('password');
Now not knowing how you authenticate those passwords this might not work.
If it's an internal web page via PHP all you do is MD5 the users supplied password and compare to you DB.
Dan Tappin (The other Dan T)
On Mar 1, 2005, at 5:09 PM, Rob Tanner wrote:
WE have a number of PHP webpages that access one of several MySql databases and while the PHP files that contain the passwords cannot be accessed via the web, we are becoming increasingly concerned over the possibility of other webpage maintainers viewing those files. How have other folks protected database passwords needed by PHP apps? Thanks.