note 82959 deleted from function.mysql-connect by danbrown
| From: | danbrown@php.net | Date: | Mon, 21 Jul 2008 16:22:36 +0000 |
| Subject: | note 82959 deleted from function.mysql-connect by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-142425@lists.php.net to get a copy of this message | ||
Note Submitter: Jouke Witteveen
----
Hiding the MySQL password is a big deal on multi-user machines.
With Lighttpd you can store the passwords in the server-config and make that file readable by root
only.
This is the way (make sure you enable mod_setenv):
# Security through setenv
$HTTP["url"] =~ "^/~user/base-dir/" {
setenv.add-environment = (
"MYSQL_USERNAME" => "username",
"MYSQL_PASSWORD" => "password"
)
}
Your PHP file should then read the username/password as follows:
<?php
$username = getenv('MYSQL_USERNAME');
$password = getenv('MYSQL_PASSWORD');
?>
Mind that additional 'false-checking' is good practice.