note 32035 added to function.mysql-connect

Another solution to the security problems of putting usernames and passwords into scripts. I haven't found this documented anywhere else so thought I'd suggest it for the online documentation. ........ Don't put passwords for mysql into scripts which may be read by any user on the machine. Instead put them into an Apache configuration file and make sure that it is not world-readable. (Apache reads its main config files as root.) For example, add this to your httpd.conf (and chmod it to 600 or 660) then tell your apache to reload itself (apachectl graceful). <Directory /var/www/html/mydatabase> php_value mysql.default_user fred php_value mysql.default_password secret php_value mysql.default_host server.example.com </Directory> Then all you need in your PHP code is $handle = mysql_connect() || die(mysql_error()); The passwords etc will only be picked up by scripts running in the named directory (or a sub-directory). The same may be done for virtualhosts etc. If you don't want to keep reloading your Apache server then you ay test things putting the php_value directives into a (world readable) .htaccess file. (Clearly not for production use.) If you need to debug the values that are being supplied (or not) then use this snippet: @syslog(LOG_DEBUG, "Using user=".ini_get("mysql.default_user"). " pass=".ini_get("mysql.default_password"). " host=".ini_get("mysql.default_host")); (This assumes that you are not running in 'safe_mode' and that you are on a unix of some sort.) -- http://www.php.net/manual/en/function.mysql-connect.php http://master.php.net/manage/user-notes.php?action=edit+32035 http://master.php.net/manage/user-notes.php?action=delete+32035 http://master.php.net/manage/user-notes.php?action=reject+32035