note 14143 deleted from function.mysql-connect by jimw
| From: | jimw@php.net | Date: | Sat, 08 Dec 2001 19:48:28 +0000 |
| Subject: | note 14143 deleted from function.mysql-connect by jimw | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-22124@lists.php.net to get a copy of this message | ||
Another much safer way to make sure your database login username and password are kept safe is to
have a file in your home/private directory (not your www directory, which is public) named
'mysqlinfo', and have in the file a simple textual line like this:
<username>:<password>:<mysql_servername>
(Note: the colons must be there, but not the brackets).
Obviously you want your 'private' directory to be private indeed, set something like this:
drwxrwx--- username nobody 1024 Mar 02 03:19 private/
and your file 'mysqlinfo' inside private/ to be restricted also:
-r--r----- username nobody 36 Mar 02 03:19 mysqlinfo
(you will need to chmod and chgrp commands to make sure this is all set properly -- ask a Linux guru
to assist you if you are not familiar with this, or ask your Server Administrator or Host Provider)
Then use the following in your PHP script to get the data for logging into your database:
<?php
unset($userpass);
unset($dbusername);
unset($dbpassword);
unset($dbhostname);
$filename = '/home/<username>/private/mysqlinfo';
$fp = fopen("$filename", 'r');
$contents = fread($fp, filesize($filename));
fclose($fp);
$array = explode(":", $contents);
$dbusername = $array[0];
$dbpassword = $array[1];
$dbhostname = $array[2];
?>
Now when you use msql_connect, you can use these $db* variables as your parameters without putting
your username and password right into your script.
I wish I could take credit for this nifty but simple advice, but I cannot. I'm just spreading
the love.