Databases
StackOverflow2013
Postsdbo
POIs my method for protecting MySQL DB password secure?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POIs my method for protecting MySQL DB password secure?
    primarykey
    data
    text
    <p>When using:</p> <pre><code>$con = mysql_connect('localhost','user','password') </code></pre> <p>I have read about the benefits of storing the password part elsewhere (<a href="https://stackoverflow.com/a/3354457/1704651">https://stackoverflow.com/a/3354457/1704651</a>).</p> <p>I'm fairly new to PHP and want to know if my method of storing MySQL passwords is secure:</p> <ol> <li>Step one, choose a lengthy MySQL Database Password (<a href="https://www.random.org/passwords/?num=1&amp;len=24&amp;format=html&amp;rnd=new" rel="nofollow noreferrer">https://www.random.org/passwords/?num=1&amp;len=24&amp;format=html&amp;rnd=new</a>)</li> <li><p>Step two, put this in /outsidewebroot/salt.php (my actual salt is longer)</p> <pre><code>&lt;?php $salt = sdcjbdt8veADJbyuQxsfJtYeW7tC5; ?&gt; </code></pre></li> <li><p>Step three, encode password using a temporary PHP file (which is deleted after use):</p> <pre><code>$decrypted = "my decrypted MySQL password" $key = $salt; $encrypted = base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256, md5($key), $decrypted, MCRYPT_MODE_CBC, md5(md5($key)))); var_dump($encrypted); </code></pre></li> <li><p>Step four, put this code in .htaccess</p> <pre><code>SetEnv encrypted-password i3NOByNkztBtEbJ8LJMt2GbX9VjMzO2MTYtBXsxyYVI= </code></pre></li> <li><p>Step five, put this code where you need to connect to your database:</p> <pre><code>require_once("../../outside-webroot/salt.php") $key = $salt $decrypted = rtrim(mcrypt_decrypt(MCRYPT_RIJNDAEL_256, md5($key), base64_decode($encrypted-password), MCRYPT_MODE_CBC, md5(md5($key))), "\0"); $con = mysql_connect('localhost','user',$decrypted) </code></pre></li> </ol> <p>The salt in /outsidewebroot/salt.php is the same one that I use for hashing passwords in my database so I only have to include it once for two uses.</p> <p>The encrypt/decrypt method I saw here: <a href="http://ideone.com/yQIAX" rel="nofollow noreferrer">http://ideone.com/yQIAX</a></p> <p>I have also seen this method: <a href="https://stackoverflow.com/a/3354457/1704651">https://stackoverflow.com/a/3354457/1704651</a> using a hash instead of the encrypt/decrypt method.</p> <p>Thank you for your feedback on my method.</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PTQuestion
    1. USCommunity
    1. USn00dle
    plurals
    1. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POIs my method for protecting MySQL DB password secure?
      1. USn00dle
      1. VTFavorite
    1. COOne of the first way to secure it is to connect to mysql db with mysqli or POD with prepared statement. You want to stop injection from happening.
      singulars
      1. POIs my method for protecting MySQL DB password secure?
      1. USMoe Tsao
    2. COInstead of putting a lot of effort in the encryption of the mysql password, you should put that effort in making your site secure. I have no problem giving you the IP and mysql password of my site!
      singulars
      1. POIs my method for protecting MySQL DB password secure?
      1. USJvdBerg
    3. COJvdBerg, I'm quite new to this! How have you protected your database? Do you have a link? Kind regards,
      singulars
      1. POIs my method for protecting MySQL DB password secure?
      1. USn00dle
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload