Re: SQLite security
| From: | Kevin Waterson | Date: | Mon, 23 Aug 2004 18:41:45 +0000 |
| Subject: | Re: SQLite security | ||
| References: | 1 2 3 4 5 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-12313@lists.php.net to get a copy of this message | ||
This one time, at band camp, Derick Rethans <derick@php.net> wrote:
> > I would like to distribute a tarball for a PHP application that can be
> > dropped into someones website along the same lines as PostNuke,
> > phpMyAdmin etc (you get the idea).
>
> Perhaps this is exactly why PostNuke is considered insecure?
A simple solution is to hard code the path to the database as
$dbname = $_SERVER['DOCUMENT_ROOT'].'/../my_safe_db.sqlite
The database will be created outside the web root and in
user space.
Kevin
--
______
(_____ \
_____) ) ____ ____ ____ ____
| ____/ / _ ) / _ | / ___) / _ )
| | ( (/ / ( ( | |( (___ ( (/ /
|_| \____) \_||_| \____) \____)
Kevin Waterson
Port Macquarie, Australia