PDO instance security

Question

Having a Class with pre-built queries that can be altered is the main known method; but say that there is about 80 tables, each holding thousands of rows of data, it would take so long to write each of them queries...

I'd just like to understand why having an open connection in a main scope is actually a security issue - how can they "intercept" it?

Take for example:

// Main index page
$db = new PDO('mysql:host=x;dbname=x;','user','pass');

Would this be a threat and if so how? (since its never reverted back to null)

Or would this be a more secure method of doing the above since the instance is never saved?

final class DataCenter
{
    public static function GetInstance()
    {
        return new PDO('mysql:host=x;dbname=x;','x','x');
    }
}

$smpt = DataCenter::GetInstance()
        ->Prepare("SELECT * FROM x");
$smpt->Execute();
$smpt->FetchAll();
print_r($smpt);

If this is confusing, I apologise - I just want to know: if instancing a PDO connection which never dies or is reverted back to null is a security issue, how so? Since the users cannot see the code.

Thanks in advance.

What do you think is *insecure* about that? What's the attack scenario you're worrying about and are trying to protect against? — deceze, Apr 05 '16 at 08:32
What's your precise concern? If the user can log into the server and attach a debugger to your PHP thread or something, you have bigger problems :-? — Álvaro González, Apr 05 '16 at 08:32
I was having a convosation with a peer and they where more than sure that establishing connections in a 'global' scope can be 'intercepted'. I am just now really curious to whether this is true or not and if so, how is that even possible @deceze — Jaquarh, Apr 05 '16 at 08:33
Any more details on who may "intercept" such connections...? — deceze, Apr 05 '16 at 08:34
no idea, I think - to my gathering - that he meant that hackers have Software upon which monitor connections on your server? I think he called it Port-Sniffing but I am only a programmer and am not to sure what any of this means but if it its true, then I got a lot of code to change haha @deceze — Jaquarh, Apr 05 '16 at 08:36
All PHP variables die at the end of the request, so once the client has gotten data back, the connection has already been closed. At the same time opening a connection to get data cannot be avoided so I don't think it's a matter of which scope of a PHP script it's in. — apokryfos, Apr 05 '16 at 08:37
It is true that you can use a [MITM (man in the middle)](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) attack to get data from various ports IF SSL/TLS isn't used and IF your host is external, but regardless of where in your PHP code you do this (global or not) it isn't more or less interceptable. If you want to protect yourself against MITM use a certificate to validate your destination. If you use a local database MITM is not possible. Please read [MySQL - 6.3.11 Using Secure Connections](http://dev.mysql.com/doc/refman/5.7/en/secure-connections.html). — h2ooooooo, Apr 05 '16 at 08:40
Never even heard of MITM, I'll search this. I am only really aware of **XSS** and **SQLi Injections** @h2ooooooo — Jaquarh, Apr 05 '16 at 08:43
MITM is a network term. XSS and SQL injections are web terms. MITM can happen to any port as it attaches to your IP - not a specific port. Doesn't matter whether it intercepts data on MySQL ports, IMAP/POP3 ports, USEnet ports, MSN ports, HTTP ports etc. It's why websites use HTTPS in the first place - to avoid a person putting themselves into the middle of the conversation. — h2ooooooo, Apr 05 '16 at 08:47
Wow, so realistically, you rely more on your hosting company than you do on your coding? I fully hope they have a better understanding of it than I do @h2ooooooo — Jaquarh, Apr 05 '16 at 08:49
@KyleE4K Absolutely your hosting company means a lot more than your own coding does. They use actual servers that, if not kept updated, could be hacked in thousands of ways if their network security isn't top notch with commercial firewalls and warnings. Most hosting companies do keep their databases on the same network that the webservers are on though, which means that the traffic should never leave their datacenter, and hence a hacker would have to hack into their datacenter to intercept. If a hacker have gotten that far there's nothing you can do except finding better hosting providers. — h2ooooooo, Apr 05 '16 at 08:51
..that said, your own code is ALSO important to have secure, but most of the time you can break way more things by having an insecure server rather than than insecure code. — h2ooooooo, Apr 05 '16 at 08:52
I could get into a mad discussion about how school/college don't teach things but this isn't the time nor the place haha, looks like I'll have to do my own research. I appreciate this addition to the post, I can finally shine light on the security issues in Software Development but not only code security. Thanks @h2ooooooo — Jaquarh, Apr 05 '16 at 08:56
Realise that you're relying on a whole stack of software which your own code runs on; starting at the BIOS/firmware, through the OS, TCP/IP stack implementation, web server, PHP and anything else in between and around. Your little bit of code sits on top of an iceberg of dependencies. **Any single one of these pieces** may bring your security tumbling down if it has exploitable holes. Not the mention the boneheaded mistakes you'll be making yourself. Be afraid. Be *very* afraid. — deceze, Apr 05 '16 at 09:04
Like they say, the second you turn something into a node, it inherits all the security issues that computer systems have :( #RIP #Technology @deceze — Jaquarh, Apr 05 '16 at 09:11

score 3 · Accepted Answer · edited May 23 '17 at 11:45

establishing connections in a 'global' scope can be 'intercepted'

Well, no, that's completely bunk. Variable scope is only a thing that helps you organise your code in a maintainable and sane way. It is not a security measure by any stretch of the imagination. If somebody, anybody, can "intercept" global variables on your server, then they can intercept all kinds of variables and memory contents of your server. Because it would mean that they're on your server poking around your memory. If an attacker is there already, you're dead in the water anyway.

Global variables aren't any more insecure "from outside" your server (where your average attacker would reside, hopefully) than any other kind of variable.

Note that there are still any number of other arguments against global variables, but security isn't one of them.

That's perfect, you also just saved me a lot of time changing a lot of code! I'll mark that when I can. Appreciated! — Jaquarh, Apr 05 '16 at 08:41

PDO instance security

1 Answers1