note 32035 modified in function.mysql-connect by philip

Another solution to the security problems of putting usernames and passwords into scripts. I haven't found this documented anywhere else so thought I'd suggest it for the online documentation. ........ Don't put passwords for mysql into scripts which may be read by any user on the machine. Instead put them into an Apache configuration file and make sure that it is not world-readable. (Apache reads its main config files as root.) For example, add this to your httpd.conf (and chmod it to 600 or 660) then tell your apache to reload itself (apachectl graceful). <Directory /var/www/html/mydatabase> php_value mysql.default_user fred php_value mysql.default_password secret php_value mysql.default_host server.example.com </Directory> Then all you need in your PHP code is $handle = mysql_connect() or die(mysql_error()); The passwords etc will only be picked up by scripts running in the named directory (or a sub-directory). The same may be done for virtualhosts etc. If you don't want to keep reloading your Apache server then you ay test things putting the php_value directives into a (world readable) .htaccess file. (Clearly not for production use.) If you need to debug the values that are being supplied (or not) then use this snippet: @syslog(LOG_DEBUG, "Using user=".ini_get("mysql.default_user"). " pass=".ini_get("mysql.default_password"). " host=".ini_get("mysql.default_host")); (This assumes that you are not running in 'safe_mode' and that you are on a unix of some sort.) --was-- Another solution to the security problems of putting usernames and passwords into scripts. I haven't found this documented anywhere else so thought I'd suggest it for the online documentation. ........ Don't put passwords for mysql into scripts which may be read by any user on the machine. Instead put them into an Apache configuration file and make sure that it is not world-readable. (Apache reads its main config files as root.) For example, add this to your httpd.conf (and chmod it to 600 or 660) then tell your apache to reload itself (apachectl graceful). <Directory /var/www/html/mydatabase> php_value mysql.default_user fred php_value mysql.default_password secret php_value mysql.default_host server.example.com </Directory> Then all you need in your PHP code is $handle = mysql_connect() || die(mysql_error()); The passwords etc will only be picked up by scripts running in the named directory (or a sub-directory). The same may be done for virtualhosts etc. If you don't want to keep reloading your Apache server then you ay test things putting the php_value directives into a (world readable) .htaccess file. (Clearly not for production use.) If you need to debug the values that are being supplied (or not) then use this snippet: @syslog(LOG_DEBUG, "Using user=".ini_get("mysql.default_user"). " pass=".ini_get("mysql.default_password"). " host=".ini_get("mysql.default_host")); (This assumes that you are not running in 'safe_mode' and that you are on a unix of some sort.) http://www.php.net/manual/en/function.mysql-connect.php