0

Possible Duplicate:
Is it ever ok to store password in plain text in a php variable or php constant?

I used to store my db credentials in a PHP file like this:

<?php
    define('HOST', 'localhost');
    define('USER', 'db_user');
    define('PASS', 'user_pass');
    define('DB', 'database');
?>

I use constants but in a recently project, one of the PHP coders said that storing db credentials into constants wasn't secure. I don't get it. I tried to find some information but nobody says nothing about this.

Is there any security risk in storing db credentials into PHP constants?

Community
  • 1
  • 1
Kete
  • 70
  • 1
  • 7

2 Answers2

3

The only risk is if you have the definitions under the document root. In that case, if something goes wrong with your server configuration and people can see your PHP code, the constants (and thus database credentials) will be exposed.

The most secure way (that I know of) is to have the credentials as part of the server environment that is restricted only to root. Then, developers can use _SERVER['db_user'], etc. This is potentially more secure in that the people who have access to the actual DB credentials are more limited. It also gives you the flexibility to use different credentials depending on the server (development vs. production, for example). However, you can see all server environment variables with phpinfo(), var_dump($_SERVER), etc. so you have to take care not to upload such things.

Explosion Pills
  • 188,624
  • 52
  • 326
  • 405
1

Is there any security risk in storing db credentials into PHP constants?

There always is some risk in storing important information, like username and password for a database.

But I can not imagine that using a constant is more a security risk than like saying using a variable.

A potential risk however is, that the configuration is written in code. So it's not really static. It's probably more fail-safe to use a configuration file instead which does not need to be executed itself.

hakre
  • 193,403
  • 52
  • 435
  • 836
  • Yeah. I don't understand why a constant could be risky. The thing is he told us to use all database credentials in attributtes of the DB class. So the PDO statment will be: `$this->myconn = new PDO("mysql:host=".$this->db_host.";dbport=".$this->db_port.";dbname=".$this->db_name, $this->db_user, $this->db_pass);` – Kete Jan 31 '12 at 08:52
  • That actually is a much wiser decision. Constants are available everywhere, if you have private object members, you need to know the location specifically. It's more work for an attacker script to locate the credentials. Beside that (which is not actually much but a little), it sound much better design wise. – hakre Jan 31 '12 at 11:33