Protecting database password in a PHP file?

Question

I have a php file which retrieves some important data from my database, for now if anybody access the php file via URL, it directly displays the data which i don't want to happen. Is it possible create a password input box which will prompt for the database password and assign its value to $password variable (see the code below) , so that only if the user inputs the correct password, only then the file will interact with the database?

UPDATE TO THE EXAMPLE CODE :

<?php
$con=mysqli_connect("example.com","peter","abc123","my_db");
// Check connection
if (mysqli_connect_errno()) {
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
$result = mysqli_query($con,"SELECT * FROM Persons");

while($row = mysqli_fetch_array($result)) {
echo $row['FirstName'] . " " . $row['LastName'];
echo "<br>";
}

mysqli_close($con);
?>`

When this php file is accessed via a browser, it displays :

Peter Parker
Glenn Forbes

I don't want people to see the output directly! I want them to first input the password, so that php file interacts with the database and displays the output!

Hope you people got me this time!

Answer 1

If I were you (and if I'm understanding your problem correctly) I would use an htaccess file. Basically, you will create two files in the directory you want to protect. The first, you will name .htaccess. That's all you need in the file name. Open the file in an editing program (e.g: Notepad++) and insert the following code:

    AuthType Basic  
    AuthName "restricted area"  
    AuthUserFile "the/path/to/the/directory/you/are/in/.htpasswd" 
    require valid-user

The .htpasswd you see is the file name of the second file you will create. Create that file (with the name .htpasswd), and open it to edit it. In that file, type in the username of the person who is to enter the directory.

    JohnDoe

Followed by a colon.

    JohnDoe:

Now, go to a website like http://www.htaccesstools.com/htpasswd-generator/ and type in the Username (just put in "test") and password you want in the fields provided. Submit the information.

After you do that, it will pop up with a formatted line of information. Copy the mess of letters after the colon and paste them after the colon in your .htpasswd file. Save your work.

    JohnDoe:$apr1$eBsB98Mg$93ckYxSmT5BBfPqOS5a/6.

Now that you have done all that, when someone goes to the directory on your website, they will be prompted to give the username and password. If they know it, it will let them in, and then display what is in your PHP file (you will need to make sure the file is named index.php.

I hope that helps!

Answer 2

There are many ways...

<?php
if($_GET['token'] != 'a1a2a3a4a5') {
    die('Wrong request!');
}
$con=mysqli_connect("example.com","peter","abc123","my_db");
// Check connection
if (mysqli_connect_errno()) {
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
$result = mysqli_query($con,"SELECT * FROM Persons");

while($row = mysqli_fetch_array($result)) {
echo $row['FirstName'] . " " . $row['LastName'];
echo "<br>";
}

mysqli_close($con);
?>

Then access your page from:

http://www.example.com/readdata.php?token=a1a2a3a4a5

Answer 3

Apache (or any other server) will execute files based on the file extension it sees and that it has been told what to do with. If that isn't told specifically, it will display it simply as text.

If your server is running PHP files fine, you can include any filename you like - that includes the extension and PHP will assume it is simply PHP. If you try to get tricky however and call it a .php5 or a .include and you haven't set up your server to run these file types as PHP, it will be output to the user as simply text.

Set up the file types properly on your server or call them all by the default extension.

Based on the code you provided:

<?php
$host = "localhost";
$db_name = "NAME_OF_THE_DATABASE";
$username = "root";
$password = "PASSWORD_OF_THE_DATABASE";
?>

A user entering this exact URL will see a grand total of NOTHING. That is because when the file is being executed as PHP, it simply assigns the variables values - it doesn't ever display them.

If the file isn't associated as a PHP executable file, your server will send the contents to the user as they are - showing all your code as you wrote it.

Answer 4

From your question what i understood is you don't want any body to see the password, so i think
you can encrypt you php code and still run it on the server

user the following tools

you can definitely hide/encode/encrypt the php source code and 'others' can install it on their machine. You could use the below tools to achieve the same.

• Zend Guard
• IonCube
• SourceGuardian
• phpSHIELD

Answer 5

You should not see the code in the screen unless your file add .php, check extension. I suggest you separate database detail in a new php file, and move it in up level directory

HTML CODE:

<form action="{your url}">
  Please enter you password:<input name="password" type="password" />
  <input type="submit" value="Submit" />
</form>

PHP code:

$password=$_GET['password'];
if($password=="1234"){

echo 'correct password';

//and add your code here

}