Best way to secure SQL password

Question

I am using many PHP scripts and I have database information inside each file, including database name and password.

I want to secure this piece of information, to make sure no one can gain access.

The information could be stored in a separate file which would then be read by the PHP script when needed.

My question is - where do I store it, how, and how do I prevent unauthorized access to that file? I'm also open to other suggestions, anything which will secure the password in the best possible way.

Move that file out of website public files, someplace that isn't accessible by browser. — Mihai Iorga, Mar 06 '13 at 12:12
You can set read/write/access permissions to the file that contains the database credentials. — guanabara, Mar 06 '13 at 12:12

Explosion Pills · Answer 1 · 2013-03-06T12:24:04.217

There may be an even better solution, but I store mine as part of the apache environment startup (only readable by root on the server). You could do the same, or some analog if you're using a different server technology.

#site.example.com
Include includes/credentials/site.conf

#includes/credentials/site.conf
<Directory /srv/www/html>
    SetEnv DB_HOST "server"
    SetEnv DB_USER "user"
    SetEnv DB_PASS "passwd"
</Directory>

This also allows you to control "credentials" per-directory, if that helps you.

In php, you can connect with something like:

$pdo = new PDO("mysql:host=$_SERVER[DB_HOST]", $_SERVER['DB_USER'],
    $_SERVER['DB_PASS']);

EDIT: This also gives you the flexibility to alter credentials when you want to connect to something else like your own mysql instance. You can use a .htaccess to override, or change the environment if you have control over that (probably preferred).

Nice usage of existing security measures in Apache. – Boris the Spider Mar 06 '13 at 12:20 — Boris the Spider, Mar 06 '13 at 12:20

score 0 · Answer 2 · edited May 23 '17 at 12:11

0

Having DB Info in your business files is really dangerous from maintenance point of view. Think of the amount of work you would have to do, if you move your website to a new server.

I would suggest use the Data Access Object Pattern

Now in whatever folder you have this DAO class, put a simple index.html which displays a blank page when accessed. Joomla uses this method based on the provided rationale.

edited May 23 '17 at 12:11

Community

1
1

answered Mar 06 '13 at 12:17

Srihari

766
1
6
22

3

Or... just move it out of a web-accessible directory. – Waleed Khan Mar 06 '13 at 12:18

Best way to secure SQL password

2 Answers2