Php database connection security check

Question

Well, I'm creating Database connection with following php code:

<?php 
define('DB_HOST', 'localhost');
define('DB_USER', 'root');
define('DB_PASSWORD', '');
define('DB_DATABASE', 'evantechbd');

$db = mysql_connect(DB_HOST, DB_USER); 
if (!$db)
{
die('Could not connect to Server: ' . mysql_error());
}
if (!mysql_select_db("evantechbd",$db))
{
die('Could not connect to DataBase : ' . mysql_error());
} 
?>

Is it really secure ?

Is there some specific reason you're worried this isn't secure? Also, the mysql_* functions are being deprecated. — ceejayoz
– ceejayoz, Commented Jan 21, 2012 at 18:50

ceejayoz · Accepted Answer · 2012-01-21 18:49:45Z

2

The biggest security issue is that your root database user really should have a password.

answered Jan 21, 2012 at 18:49

ceejayoz

181k42 gold badges311 silver badges382 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

user1161867 Over a year ago

Well, i'm just test it on my localhost server. when i upload it to server i must be change this. But is it secure?

ceejayoz Over a year ago

Define "secure". What are you trying to protect against? Other parts of your code are more likely to be an issue.

user1161867 Over a year ago

protect to hacking.. What is the issue?

ceejayoz Over a year ago

The issue is that this code does essentially nothing by itself. There's not really any avenue for a web user to attack here, but when dealing with SQL, there are plenty of things to protect against, like SQL injection.

ceejayoz Over a year ago

None of this code is vulnerable to SQL injection, as you aren't actually doing anything with SQL other than connecting in this code. See en.wikipedia.org/wiki/SQL_injection

|

Vyktor · Accepted Answer · 2012-01-21 19:12:23Z

1

Secure against what?

If you want it to secure against "rough module", it's not. All defined values will be accessible anywhere in included file (you should use config and unset it unset initialization).

$config = parse_ini_file( 'configs/config.php');
mysqli_connect( isset( $config['host']) ? $config['host'] : 'localhost',
    isset( $config['user']) ? $config['user'] : 'root', ...);
// Select DB
unset( $config);
// Prohibit your modules from opening any file

Against webuser? Again no. You're displaying error to end user. You're telling anyone that you're connection to localhost with user root if connection fails for any reason (you should use throw an exception, trigger error and notify user just about database error, send mail to yourself and log the error).

And using root without password is quite a big security issue, but I'm assuming that's just example data.

edited Jan 21, 2012 at 19:12

answered Jan 21, 2012 at 18:53

Vyktor

21.1k6 gold badges69 silver badges98 bronze badges

4 Comments

kba Over a year ago

+1. Also, using the root user in production code isn't a good idea either. A specific user should be created for each application on the server, so if the database information should get compromised, only one site would be affected.

user1161867 Over a year ago

can you please give an example?

Vyktor Over a year ago

@KristianAntonsen yeah, you're right. We allow connection only from localhost on our mysql servers which makes great deal in security, but there are still applications (such as phpMyAdmin) which can be abused. I prefer naming users like web_ae79ec (with random hash as suffix) and long (about 8-20 characters) password.

user1161867 Over a year ago

example about your first suggestion

Collectives™ on Stack Overflow

Php database connection security check

2 Answers 2

6 Comments

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

6 Comments

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related